Vercel finds evidence of earlier data breach activity

Vercel, an app and website hosting company, announced on Thursday that it has identified evidence of malicious activity on its network that predates its early-April breach. The discovery suggests that the data breach may be larger in scope and could have lasted longer than initially thought. Vercel identified this evidence after expanding its initial investigation into the security incident. While the company discovered additional customer accounts compromised by the April incident, it did not disclose specific details, stating only that it has notified the affected customers. A Vercel spokesperson declined to comment beyond the update, refusing to confirm how many customers are currently affected or how far back the earlier compromise dates. “We have uncovered a small number of customer accounts with evidence of prior compromise that is independent of and predates this incident, potentially as a result of social engineering, malware, or other methods,” said Guillermo Rauch, the CEO of Vercel.

Regarding how the systems were accessed, Rauch pointed to early signs that the hackers relied on malware that compromises computers in search of valuable tokens, such as account keys. This refers to infostealer malware, which is information-stealing software that collects sensitive secrets from a victim’s computer. Rauch explained that once an attacker gets ahold of those keys, Vercel’s logs show a repeated pattern of rapid and comprehensive API usage, with a focus on the enumeration of non-sensitive environment variables—the dynamic-named values that can affect how running processes behave on a computer.

The investigation shows that the activity of the hackers extends beyond the compromise of Context AI, a software startup whose application was abused by hackers to access Vercel’s systems. Initially, Vercel reported that its internal systems were breached after an employee downloaded an application developed by Context AI. Hackers then abused this application to gain access to the employee’s work account and subsequently enter Vercel’s systems, where they accessed customer credentials that were not encrypted. The security posture of Context AI has drawn additional scrutiny because it was certified by Delve, a compliance startup currently accused of faking customer data.

Why it matters

The discovery of malicious activity predating the known breach suggests the incident may have broader security implications and a longer duration than initially thought.