App host Vercel says it was hacked and customer data stolen

Vercel disclosed that attackers leveraged an OAuth integration from a Context AI app to hijack an employee Google account and access internal systems, exfiltrating unencrypted customer credentials, API keys, source code and database data. The stolen data was advertised for sale on a cybercrime forum (a seller claimed ShinyHunters, who deny involvement); Vercel has contacted affected customers and recommended rotating keys. Context AI confirmed a prior breach that likely compromised OAuth tokens; the incident may affect hundreds of users and pose downstream supply-chain risks while investigations continue.