Vercel identifies more accounts ‘with evidence of prior compromise’ exposed in security incident

• Vercel expanded its investigation into the breaches, confirming more compromised accounts than initially reported.
• Researchers linked the attack to a Context.ai account infected with Lumma Stealer malware, which was used to access Vercel environments.
• A Dark Web actor attempted to sell stolen Vercel data, claiming ties to ShinyHunters, although the group has denied involvement.

The number of customers affected by the recent breach at Vercel is larger than initially thought, with the company confirming that it has discovered even more compromised accounts.

Earlier this week, the cloud development platform confirmed it suffered a cyberattack and lost “non-sensitive” customer data. In the initial report, Vercel said one of its employees used a third-party AI tool called Context.ai, which appears to have been used as an entry point.