Was Vercel directly hacked?

No. The breach originated at Context.ai, a third-party AI productivity tool. A compromised OAuth token was replayed to access a Vercel employee's Google Workspace, which led to Vercel's internal systems. Vercel's core deployment infrastructure was not directly penetrated.

What data was exposed in the Vercel breach?

Non-sensitive environment variables stored in plaintext, 580 employee records including names and email addresses, and potentially API keys and database credentials. Variables flagged as 'sensitive' in Vercel's dashboard were encrypted at rest and were not accessed.

Should I stop using Vercel after this breach?

Not necessarily, but you should audit your setup immediately. Rotate all environment variables, enable the 'sensitive' flag for every secret, review third-party OAuth grants on your Google Workspace, and enable two-factor authentication on all accounts.

How do I check if I'm affected by the Vercel breach?

Review your Vercel activity logs for unfamiliar access. Check Google Workspace for third-party OAuth grants from Context AI (App ID: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj). Rotate API keys stored as non-sensitive environment variables. Vercel says it contacted affected customers directly.

What is Lumma Stealer malware?

Lumma Stealer is an infostealing malware that became the most prevalent credential-stealing tool of 2025. It harvests saved passwords, session cookies, and tokens from infected machines. In this breach, it infected a Context.ai employee's device via fake Roblox game exploit downloads.

Back to Blog

SecurityBy Ciphera Team11 min read21-04-2026

How the Vercel Data Breach Happened — And What It Means for Every Developer

Security10 min read

What Happened in the Basic-Fit Data Breach — and Why Your IBAN Makes It Dangerous

Security8 min read

DarkSword iPhone Exploit: 221 Million iOS Devices at Risk and How to Protect Yours

Security9 min read

How We Stopped a Bot Account Farming Attack With Zero-Knowledge Auth

Back to all posts

How the Vercel Data Breach Happened — And What It Means for Every Developer

Related Articles

What Happened in the Basic-Fit Data Breach — and Why Your IBAN Makes It Dangerous

DarkSword iPhone Exploit: 221 Million iOS Devices at Risk and How to Protect Yours

How We Stopped a Bot Account Farming Attack With Zero-Knowledge Auth