Vercel Confirms Unauthorized Access as ShinyHunters Claims Internal Breach
Summary
Vercel confirmed unauthorized access to some internal systems and says core services remain operational. ShinyHunters claims stolen assets, while Vercel investigates and advises rotating non-sensitive environment variables and reviewing audit logs.
Key points
- Vercel confirmed unauthorized access to some internal systems; it has not confirmed the full extent of the actor’s claims.
- A threat actor claiming affiliation with ShinyHunters said it was selling source code, database access keys, NPM and GitHub tokens, and 580 employee records.
- Vercel said a limited subset of customers was directly impacted; its core services remain operational.
- Vercel engaged Google Mandiant and Context to assist with the investigation and remediation, and notified law enforcement.
- Vercel said it has no evidence that environment variables marked sensitive were accessed; it advised rotating secret-bearing variables not marked sensitive.
- The company advised developers to review Vercel activity logs. Investigators are examining whether Next.js or Turbo.js repositories were tampered with.
Article Details
- Victim Organization
- Vercel
- Incident Type
- Unauthorized access to internal systems; alleged theft of assets and potential supply-chain compromise. Repository tampering was under investigation and not confirmed.
- Disclosure Date
- 2026-04-19
- Data Types Exposed
- Proprietary source code (alleged)
- Database access keys (alleged)
- API keys, including NPM and GitHub tokens (alleged)
- Employee names, internal email addresses, and activity timestamps (alleged)
- Affected Records
- 580 employee records allegedly included in a file shared by the threat actor.
- Affected Data Size
- Not disclosed
- Operational Impact
- Vercel said its core services remained operational and that a limited subset of customers was directly impacted. The extent of the incident was still under investigation.
- Ransom Or Extortion
- A threat actor claiming to be part of ShinyHunters said stolen assets were being offered for sale. No ransom amount or payment demand was reported.
- Claim Status
- confirmed
Threat Actors
Vendors
ContextVercel confirmed unauthorized access to some internal systems, engaged Google Mandiant and Context, said core services remain operational while investigators probe whether Next.js or Turbo.js were tampered with, andGoogle MandiantVercel confirmed unauthorized access to some internal systems, engaged Google Mandiant and Context, said core services remain operational while investigators probe whether Next.js or Turbo.js were tampered with, and
Products
GitHubVercel’s internal infrastructure and are selling stolen assets, including source code, databases, NPM and GitHub tokens, and a file with 580 employee records.Next.jsGoogle Mandiant and Context, said core services remain operational while investigators probe whether Next.js or Turbo.js were tampered with, and advised developers to rotate any non-sensitive environment variablesnpmbreached Vercel’s internal infrastructure and are selling stolen assets, including source code, databases, NPM and GitHub tokens, and a file with 580 employee records.Turbo.jsMandiant and Context, said core services remain operational while investigators probe whether Next.js or Turbo.js were tampered with, and advised developers to rotate any non-sensitive environment variables and reviewVercelactor claiming to be part of the ShinyHunters extortion group posted on April 19, 2026 that they breached Vercel’s internal infrastructure and are selling stolen assets, including source code, databases, NPM and GitHub