Vercel Breach: OAuth Attack Make Dem Demand $2M Ransom

Dem confirm say Vercel breach happen for 19 April 2026. Di web hosting and deployment platform talk say attacker enter their internal environments through one staff Google Workspace account wey dem compromise. Vercel trace di koko cause to third-party OAuth compromise wey involve Context.ai, one AI productivity tool wey at least one staff dey use. Vercel talk say customer environment variables dey encrypted when dem rest and dem get defense-in-depth controls. But di attacker reportedly pivot comot from di staff Google session through enumeration, fit expose small set of customer credentials. Vercel CEO Guillermo Rauch talk say Vercel open-source projects like Next.js and Turbopack no dey affected. One threat actor wey dey use “ShinyHunters” persona post alleged Vercel materials for one hacking forum and demand $2 million. Di post claim say dem get access to source code, API tokens, database-related contents, deployment data, and NPM/GitHub tokens, plus one text file wey list about 580 employees. Vercel talk say dem dey coordinate with Mandiant, law enforcement, industry peers, and Context.ai, and dem publish Indicator of Compromise for di malicious OAuth app. Affected customers don get notice to rotate credentials, and Vercel don update dashboard/tooling for managing sensitive environment variables. Nobody don verify if di claims true or if any ransom don pay. For crypto traders, dis Vercel breach matter because many wallet frontends and dApp deployments depend on Vercel-hosted infrastructure. So far, no direct on-chain impact report, but di incident raise operational and key-rotation risk for Web3 teams.