Vercel Admits To Customer Data Been Stolen Before Its Recent Hack

The massive app and website hosting provider Vercel revealed at a late hour on Thursday that hackers had access to some of its customers’ data prior to the company’s recent data breach, with evidence of penetration that had happened some days ago, raising the possibility that this incident may have more significant security ramifications than first thought. These earlier compromises don’t seem to have started on Vercel systems, and they also seem to be independent. 

After expanding its initial investigation, Vercel reported on its security incident page that it had found indications of hostile activity on its network prior to the early-April breach.

The company shared the update state, as they have discovered a small number of customer accounts with evidence of prior compromise that is independent of and predates this incident, possibly as a result of social engineering, malware, or other methods.

Vercel also claimed to have found other client accounts compromised by the April event; however, it did not provide specifics, rather stating that it has informed consumers who were known to be impacted thus far.

After an employee downloaded an app created by software firm Context AI, the San Francisco-based app and website hosting company first claimed that its internal systems had been compromised. Hackers then utilized this information to access the person’s work account and, thereafter, accessed Vercel’s systems.

According to the latest information, the data breach might have been more extensive and prolonged than first suspected.

Vercel CEO Guillermo Rauch shared on X that hackers that compromised Vercel have been engaged “beyond that startup’s compromise.” Last is in reference to Context AI, which last week announced an earlier breach of its systems.

Beyond the modification on the incident site, a Vercel representative had declined to comment. Neither the number of clients currently impacted by the breach nor the duration of the second compromise was disclosed.

Rauch also cited early indications that the hackers used malware that compromises various computers that are in search of valuable tokens like keys to Vercel accounts and other providers. Vercel has not yet acknowledged how the hackers had gained access to its servers.

Rauch might be referring to infostealers, or spyware that steals information and frequently poses as trustworthy software. Once installed, the virus gathers and uploads private keys and other sensitive information from the victim’s computer, enabling hackers to access any system that those keys permit.

Rauch also stated that their logs reveal a recurring pattern once the attacker obtains those keys: rapid and thorough API usage, with an emphasis on enumeration of non-sensitive environment variables.

The hackers gained access to some of the company’s internal systems, which includes unencrypted client passwords, by using the account of the compromised Vercel employee.

Rauch shared his remarks, which seem to support security experts‘ earlier findings that an employee of Context AI had infostealer malware on their machine after they purportedly searched up Roblox gaming cheats. Members of the press from TechCrunch also revealed on Thursday that the security certifications for Context AI were completed by troubled compliance startup Delve, which is suspected of fabricating client data.

The number of consumers impacted by Vercel hacks and personal data thefts is still unknown. Vercel and Context AI said that the hack might impact additional businesses and reveal more victims. 

Another source also had revealed that a Vercel employee’s authorization of a third-party OAuth app with broad permissions enabled attackers to use a compromised token from Context.AI, following earlier unauthorized access linked to social engineering or malware, to hijack the account and breach Vercel’s internal systems in a recent supply chain attack.

Also, the attachers accessed non-sensitive environment variables, often containing API keys and credentials, while sensitive variables remained encrypted and untouched, though a threat actor named ShinyHunters has claimed to be selling Vercel’s internal databases and employee records for $2 million, a claim Vercel has not verified.

In conclusion, it is advised that Vercel users should check if they were contacted by Vercel, immediately rotate all credentials from non-sensitive environment variables as if exposed, enable sensitive flags on all secrets (now the default for new variables), and audit OAuth permissions for the malicious Context.AI client ID in Google Workspace.