Vercel Confirms Breach as Hackers Sell Stolen Data

Cloud platform Vercel discloses a security incident involving unauthorized access to certain internal systems, affecting a limited subset of customers.

In a bulletin published today, Vercel states it is actively investigating with incident response experts, has notified law enforcement, and is working with impacted customers. The company's services remain unaffected. Vercel advises affected customers to review environment variables, enable its sensitive environment variable feature, and rotate secrets if necessary.

The disclosure follows a threat actor's forum post claiming a breach and offering for sale access keys, source code, database data, internal deployments, and API keys—including NPM and GitHub tokens. The actor, claiming affiliation with ShinyHunters (though the group denies involvement), shared proof from Linear, including multiple employee accounts.

The hacker posted a text file with 580 Vercel employee records containing names, email addresses, account status, and activity timestamps, plus a screenshot of an internal Enterprise dashboard. BleepingComputer has not independently verified the data's authenticity. The actor claims contact with Vercel and a $2 million ransom demand via Telegram messages.