Archive — US — techcrunch
App host Vercel says it was hacked and customer data stolen
Vercel announced a security breach where hackers accessed customer data through an exploited OAuth connection from Context AI's app. Sensitive credentials were reported stolen and put up for sale online. Vercel is investigating the incident, warning of potential downstream impacts across organizations. The hack illustrates a broader trend of supply chain attacks targeting software infrastructure.
Key points
- Breach occurred when a Vercel employee downloaded an app by Context AI, allowing hackers to hijack their Google account via OAuth.
- Sensitive customer credentials, including API keys and source code, were stolen and are being sold online.
- Vercel confirmed its major projects were unaffected but warned hundreds of users and multiple organizations could be impacted.
- The ShinyHunters hacking group was mentioned but denied involvement in this breach.
- Context AI was previously breached in March, suggesting a potential connection to the current incident.
Why it matters
- The incident reflects a growing trend of supply chain attacks, where hackers exploit vulnerabilities in widely used software to target multiple users.
- Similar recent breaches have involved major tech firms, emphasizing the need for cybersecurity vigilance in the software development and cloud hosting sectors.
- By 2025, the focus on zero trust security and improved authentication protocols is expected to rise in response to incidents like this.
The Vercel breach highlights the vulnerabilities in cloud software systems and stresses the importance of robust security measures, particularly in the context of increasing supply chain attacks targeting developer tools.