Vercel, a major development platform that hosts and deploys web apps, was compromised, and the hackers are attempting to sell stolen data. A person claiming to be a member of ShinyHunters, which was behind the recent hack of Rockstar Games, posted some data online, including employee names, email addresses, and activity time stamps. Vercel confirmed in a post on X that a “security incident” had occurred, and that it impacted a “limited subset” of its customers. Vercel said that a compromised third-party AI tool was the avenue for attack, though it did not specify which third-party was involved.
Vercel encouraged administrators to review their activity logs for suspicious activity. It also suggested taking steps to “review and rotate environmental variables” as an extra precaution in case API keys, tokens, or other sensitive data were exposed. It ended its security bulletin by saying:
Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations.
We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicious activity in their environments. We recommend that Google Workspace Administrators and Google Account owners check for usage of this app immediately.
[ad_2]
Source link
More on cloud development platform vercel was hacked
Stay tuned for updates on cloud development platform vercel was hacked as the story develops. Related: The running list: major tech layoffs in 2026 where employers cited AI.
Frequently Asked Questions
Vercel confirmed a security incident impacting a limited subset of customers, with hackers selling stolen data including employee names, emails, and activity timestamps.
A person claiming to be a member of ShinyHunters, the group behind the recent Rockstar Games hack, posted stolen data online.
Vercel said a compromised third-party AI tool was the avenue for attack; its Google Workspace OAuth app was the subject of a broader compromise potentially affecting hundreds of users across many organizations.
Vercel encouraged admins to review activity logs for suspicious activity and to review and rotate environmental variables in case API keys or tokens were exposed.
