Vercel Confirms Security Breach Affecting Customer Accounts

Vercel confirmed a security breach that began with a third-party (Context.ai) compromise which led to takeover of an employee Google Workspace account and subsequent access to Vercel accounts. The attacker accessed systems that could enumerate and decrypt non-sensitive environment variables, potentially exposing credentials for a limited number of customers; Vercel has notified affected customers, engaged external responders (including Google Mandiant), involved law enforcement, and is rolling out stronger protections while advising customers to enable MFA and rotate secrets.