Vercel CEO Guillermo Rauch has updated the investigation into the company's recent security incident, and the picture is getting messier.
The security team has now sifted through nearly 1 petabyte of network and API logs, a scope that goes far beyond the initial breach linked to Context.ai. The investigation reveals the attacker's campaign wasn't limited to that single vector. Threat intelligence indicates they were distributing malware to multiple organizations to steal tokens and keys from Vercel and other service providers.
Once they had the keys, the pattern was consistent: rapid, comprehensive API calls, with a focus on enumerating non-sensitive environment variables.
Vercel has updated its security advisory with new findings. The expanded investigation uncovered two additional categories of compromised accounts. First, a small number of additional accounts were confirmed to be affected by this specific incident. Second, investigators found evidence of separate, older breaches on a small number of customer accounts, unrelated to the current event. These older compromises may have stemmed from social engineering, malware, or other methods.
Vercel says it has notified all affected account holders in both categories. The company has also expanded its industry collaboration with Microsoft, AWS, and Wiz, and has notified other organizations that may have been targeted.