Another customer of troubled startup Delve suffered a big security incident

The saga surrounding the beleaguered compliance startup Delve continues to unfold with alarming developments. Recent reports confirm that Delve was the compliance provider for Context AI, which recently experienced a significant security breach impacting Vercel, a major app and website hosting platform. This incident marks a troubling trend for Delve, which faced accusations last month from an anonymous whistleblower claiming the startup was misrepresenting customer data and utilizing subpar auditors for its compliance certifications. While Delve has categorically denied these allegations, the fallout has been substantial. Following these claims, LiteLLM, another company associated with Delve, reported a cyber attack that resulted in malware being inserted into its open-source code. Consequently, LiteLLM announced its decision to sever ties with Delve and pursue re-certification elsewhere. The situation escalated over the weekend when Vercel revealed that hackers gained access to its internal systems after an employee inadvertently connected an app developed by Context AI to Vercel's corporate Google account. This breach allowed the attackers to exploit the employee's access and infiltrate Vercel's systems. In light of these events, Context AI confirmed that it previously partnered with Delve for security certification but has since terminated that relationship. The company is now seeking new compliance verification through Vanta and an independent audit firm, Insight Assurance. A spokesperson for Context AI acknowledged this transition, stating, "Following the reporting surrounding Delve in March, we transitioned our compliance program to Vanta." Despite the existence of security certifications, they do not eliminate security vulnerabilities. Lovable, a former Delve customer, has also been in the spotlight, revealing it had unintentionally exposed customer chat data publicly. Initially, Lovable denied any data breach, later attributing the issue to a configuration error rather than a hack. The company is now working to rectify its security processes after parting ways with Delve. Adding to the intrigue, the whistleblower, known as DeepDelver, has made further allegations against Delve, claiming the startup denied refunds to clients while sending its team on an offsite trip to Hawaii. While DeepDelver provided evidence to support this claim, TechCrunch was unable to independently verify all details. Attempts to reach Delve for comments have gone unanswered, with their media relations email bouncing back.