Vercel Confirms Unauthorized Access as Actor Claims to Sell Stolen Data

Summary

Vercel confirmed unauthorized access to internal systems affecting a limited subset of customers. An actor claiming to be ShinyHunters alleges data theft and a $2 million ransom; the shared data's authenticity is unverified, and actors linked to ShinyHunters deny they**

Key points

Vercel disclosed unauthorized access to certain internal systems and said a limited subset of customers was affected.
Vercel says its services remain operational, incident response experts are assisting, and law enforcement has been notified.
An actor claiming to be ShinyHunters said they were selling access keys, source code, database data, and access to internal deployments and API keys.
The actor shared 580 employee records and a screenshot that appeared to show an internal dashboard; BleepingComputer could not independently verify their authenticity.
The actor claimed to be in contact with Vercel about the incident and an alleged $2 million ransom demand; these claims are unconfirmed.
Vercel advised customers to review environment variables, use its sensitive environment variable feature, and rotate secrets if needed.
Threat actors linked to recent attacks attributed to ShinyHunters denied involvement in this incident.

Article Details

Victim Organization: Vercel
Incident Type: Unauthorized access to certain internal systems; alleged theft and attempted sale of company data
Data Types Exposed: Employee names, Vercel email addresses, account status, and activity timestamps were reportedly shared; authenticity was not independently verified.
The threat actor claimed to offer access keys, source code, database data, internal deployments, and API keys for sale; these claims were not independently verified.
Affected Records: 580 employee information records were reportedly shared; authenticity was not independently verified.
Operational Impact: Vercel confirmed unauthorized access affecting a limited subset of customers. The company said its services were not impacted and remained operational.
Ransom Or Extortion: The threat actor claimed an alleged $2 million ransom demand had been discussed with Vercel; this was not independently verified.
Claim Status: confirmed

Threat Actors

ShinyHuntersThe forum poster claimed to be part of ShinyHunters and claimed responsibility for the Vercel breach and data sale. The claim was unverified; actors linked to recent attacks attributed to the group denied involvement in this incident.

Vendors

VercelVercel disclosed unauthorized access to certain internal systems after a threat actor claimed to have breached its environment and offered stolen data for sale.

Industries

Cloud developmentCloud development platform Vercel has disclosed a security incident after threat actors claimed to have breached its systems and are attempting to sell stolen data.