2026 Vercel — internal systems breach; forum sale claims (~$2M); Mandiant response

In mid-to-late April 2026, Vercel publicly confirmed unauthorized access to certain internal systems, stating it engaged external incident response (reporting frequently cited Google/Mandiant–family firms), notified law enforcement, and was contacting affected parties. Follow-on analyses (e.g., Security Boulevard, InfoWorld) tied the intrusion path to abuse of a third-party AI/OAuth integration context—often named in press as Context.ai / Google Workspace OAuth—rather than a core Vercel platform flaw. Trade and intelligence summaries tied forum narratives to extortion groups such as ShinyHunters and described alleged offers to sell internal-oriented material (e.g., environment-variable and key-management context, source or operational metadata) at high nominal prices, alongside debate over copycat posts. Vercel and reporters framed customer impact as a limited subset and urged rotation of API keys and secrets—especially for workflows involving third-party OAuth/AI tooling. Treat actor claims and price tags as partially unverified. Some intelligence-style bulletins floated smaller employee-scope figures (e.g., on the order of ~580 impacted workforce records alongside broader secret-theft assertions), again distinct from finalized customer-scope tallies.