Vercel confirms breach as hackers claim to be selling stolen data

Published:

19 april 2026 om 17:32:45

Alert date:

19 april 2026 om 18:00:39

Source:

bleepingcomputer.com

Cloud & Virtualization, Data Breach & Exfiltration, Web Technologies

Cloud development platform Vercel disclosed a security incident after threat actors claimed to have breached their systems. Hackers are allegedly attempting to sell stolen data from the breach. This represents a significant security incident affecting a major cloud development platform used by many organizations and developers worldwide.

Technical details

Threat actors gained unauthorized access to certain internal Vercel systems. The attackers claim to be selling access keys, source code, database data, internal deployments, and API keys including NPM tokens and GitHub tokens. A text file containing 580 employee data records with names, Vercel email addresses, account status, and activity timestamps was shared. The attackers also shared screenshots of what appears to be an internal Vercel Enterprise dashboard and claimed they had access to multiple employee accounts with access to several internal deployments.

Mitigation steps:

Review environment variables
Use Vercel's sensitive environment variable feature
Rotate secrets if needed

Affected products:

Vercel cloud platform
Next.js framework