The Next.js Nightmare? Vercel Investigates “Critical” Internal Breach and Supply Chain Threat

On April 19, 2026 an actor claiming to represent ShinyHunters posted a listing alleging a major breach of Vercel that includes proprietary source code, databases, NPM/GitHub tokens, and 580 employee records; the actor posted screenshots and data snippets as proof. Vercel acknowledged unauthorized access affecting a limited subset of customers, engaged Mandiant and other responders, and advised rotating any non-sensitive environment variables and reviewing audit logs while the investigation continues, highlighting a potential supply-chain risk to Next.js and the broader @vercel ecosystem.