Vercel Confirms Data Breach After Hackers Attempt to Sell Stolen Information

Executive Summary

Cloud development platform Vercel has confirmed a security breach after threat actors posted stolen data for sale on a hacking forum. The company stated it is investigating the incident, which reportedly involves customer account information, project details, and internal data. The breach's full scope and root cause remain under investigation.

Technical Analysis

Vercel's disclosure followed a post on the BreachForums hacking forum where a threat actor, using the alias 'overtime,' advertised the sale of a Vercel database. The seller claimed the data included 5,300 customer records containing names, emails, phone numbers, and account types. Additionally, the listing referenced internal project information, billing details, and support tickets. Vercel's investigation, as reported by BleepingComputer, is ongoing to verify these claims and determine the extent of the intrusion. The company has not confirmed the specific data types or volume allegedly exfiltrated. The initial forum post has since been removed, but screenshots circulated prior to its deletion.

Threat Actor Context

The threat actor used the alias 'overtime' on the BreachForums platform to advertise the stolen Vercel data. The actor's motivations appear financially driven, attempting to sell the data for an undisclosed sum. There is no attribution to a known advanced persistent threat (APT) group or malware operation in the available sources. The legitimacy of the actor's claims and the provenance of the data are key points of Vercel's active investigation.

Mitigations & Recommendations

Vercel has not released specific mitigation steps for customers. Based on the nature of the claimed breach, users of the platform should:

• Monitor account and project environments for unauthorized changes.
• Enable multi-factor authentication (MFA) on Vercel and linked accounts if not already active.
• Be vigilant for targeted phishing attempts that may leverage stolen personal or project information.
• Follow official Vercel communications for further guidance as the investigation concludes.