App host Vercel says it was hacked and customer data stolen

This past weekend, Vercel, a prominent player in cloud app hosting, revealed that its internal systems had been compromised by hackers who accessed customer data. The attackers have claimed to have stolen sensitive credentials, which they are now attempting to sell online. In a statement released on Sunday, Vercel clarified that the breach stemmed from an incident involving Context AI, another software company. An employee at Vercel inadvertently downloaded an application developed by Context AI and linked it to their corporate Google account. This connection, known as OAuth, allowed the hackers to seize control of the employee's Google account, granting them access to certain internal systems at Vercel, including unencrypted credentials. Fortunately, Vercel has assured its users that their Next.js and Turbopack projects remain unaffected by this breach. These open-source projects are extensively utilized by developers in both web and app creation. Following the incident, Vercel has reached out to customers whose application data and keys were exposed. In a post on X, CEO Guillermo Rauch urged users to rotate any credentials and keys marked as 'non-sensitive' in their deployments. The identity of the hackers remains uncertain, as does any potential connection to the notorious ShinyHunters hacking group, which is known for targeting cloud services and databases. In a post on a cybercriminal forum, the group claimed to be selling access to stolen customer API keys, source code, and database information from Vercel. However, they later distanced themselves from this incident when contacted by cybersecurity journalists. This breach is part of a troubling trend of 'supply chain' attacks that have emerged recently, targeting software developers whose tools are widely used across the internet. By infiltrating commonly used software, hackers can potentially gather credentials from multiple victims simultaneously, leading to further unauthorized access to vast amounts of data. Vercel has not disclosed additional specifics about the investigation but announced that it is actively looking into the incident and seeking clarity from Context AI. The company indicated that the repercussions may extend to 'hundreds of users across various organizations,' suggesting a wider impact within the tech community. Context AI, which specializes in analytics for AI models, confirmed on its website that it experienced a breach related to its Context AI Office Suite consumer app back in March. This application automates workflows across multiple third-party services. After Vercel's announcement, Context AI acknowledged that the breach might be more expansive than initially believed, mentioning that OAuth tokens for some consumer users were likely compromised. As of now, Context AI has not provided any further comments regarding the breach or any ransom demands that may have been received. Vercel has also remained silent on inquiries regarding the number of affected customers.