Vercel Confirms Major Security Incident as Hacker Claims $2M Ransom Demand

"Vercel has identified a security incident that involved unauthorized access to certain internal systems, raising significant concerns about the exposure of sensitive data and developer environments."

"The threat actor claims to possess credentials such as GitHub and npm tokens, as well as access to multiple employee accounts that could be used to interact with internal systems."

"If the claims prove accurate, the incident points to a potential compromise of systems tied to identity and access management or development workflows, which could have serious implications."

Vercel experienced a security incident involving unauthorized access to its internal systems. A threat actor, claiming affiliation with the ShinyHunters group, alleges possession of sensitive internal data, including API keys and employee credentials. The actor shared a dataset with 580 employee records and a screenshot of an internal dashboard, though these claims remain unverified. The incident raises concerns about the exposure of critical development workflows and identity management systems, potentially compromising code repositories and deployment infrastructure.

Read at TechRepublic