App and website hosting giant Vercel said Thursday that hackers had accessed some customer data before the company discovered its latest data breach, suggesting the incident may have broader security implications than initially known.
Vercel said in an update to its security incident page that after expanding its initial investigation, it had identified evidence of malicious activity on its network prior to the breach in early April.
“We have discovered a small number of customer accounts with evidence of previous compromises unrelated to and prior to this incident, potentially as a result of social engineering, malware, or other techniques,” the update states.
Vercel also said it had discovered more customer accounts had been compromised in the April incident, but did not provide details, only saying it had notified customers known to have been affected so far.
The San Francisco-based app and website hosting company initially announced that its internal systems were compromised after an employee downloaded an app made by software startup Context AI, which the hackers exploited to gain access to the employee's work account and then to Vercel's systems.
New updates suggest the scope of the data breach may have been larger and longer-lasting than initially expected.
Vercel CEO Guillermo Rauch acknowledged in a post to
A spokesperson for Vasel declined to comment beyond the latest information on the incident page. They did not confirm how many customers this breach currently affects, nor did they say how far back the second breach goes back.
Vercel has not yet confirmed how the hackers got into its systems, but Rauch pointed to early signs that the hackers relied on malware to compromise computers “for valuable tokens such as keys to Vercel accounts and other providers.”
Rauch may be referring to infostealers, malware that steals information while masquerading as legitimate software. Once installed, this malware collects and uploads sensitive information from the victim's computer, including passwords and other private keys, allowing hackers to compromise systems that can be accessed with those keys.
“Once an attacker obtains these keys, our logs show a recurring pattern of rapid and comprehensive API usage with a focus on enumerating non-sensitive environment variables,” Rauch said.
Hackers used hijacked Vercel employee accounts to access parts of internal systems containing unencrypted customer credentials.
Rauch's comments appear to add weight to previous reports by security researchers that a Context AI employee's computer was infected with information-stealing malware after allegedly investigating cheats in the Roblox game. TechCrunch reported Thursday that Delve, a startup that has struggled with compliance after being accused of falsifying customer data, has given security certification to Context AI.
It is still unclear how many customers will be affected by the Vercel breach and theft of customer data. Both Vercel and Context AI have indicated that this breach may affect more companies and may reveal more victims.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.