Vercel Confirms Cyber Incident After Sophisticated Attacker Exploits Third‑Party Tool

Vercel confirmed a breach stemming from a third-party OAuth integration (Context.ai) that allowed a sophisticated attacker to hijack an employee Google Workspace account, access some internal environments and non-sensitive environment variables, and claim possession of API keys, tokens, source code and databases while demanding $2M; Vercel is working with Mandiant, says sensitive variables and npm packages appear uncompromised, and has advised customers to enable MFA, rotate exposed variables and review deployments.