# Vercel April 2026 Security Incident — Context.ai OAuth Compromise Leads to Google Workspace Takeover and Customer Environment Variable Exposure

> Vercel disclosed on 2026-04-19 that a third-party compromise of Context.ai — an AI tool authorized in a Vercel employee's Google Workspace — let an attacker hijack that employee account via a malicious OAuth application (client ID 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com) and read a limited subset of customer environment variables that were not marked as 'sensitive.' A threat actor posting under the 'ShinyHunters' alias is selling stolen access keys, source code, database data, NPM/GitHub tokens and 580 employee records on an underground forum and has demanded a USD 2 million extortion payment; Vercel engaged Mandiant and notified law enforcement.

- **Published:** 2026-04-20T12:00:00Z
- **Last reviewed:** 2026-04-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0394
- **ID:** TL-2026-0394
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Actor:** ShinyHunters (France)
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

INCIDENT OVERVIEW

On 2026-04-19 at 11:04 AM PST, cloud development and hosting platform Vercel published a security bulletin confirming a security incident affecting a limited subset of customers. An updated bulletin at 6:01 PM PST disclosed the root cause: compromise of Context.ai, a third-party AI tool used by a Vercel employee. Leveraging that access, the attacker hijacked the employee's Google Workspace account via a malicious OAuth application and pivoted into internal Vercel environments, reading customer environment variables that had not been marked as 'sensitive.' Vercel has engaged Mandiant for incident response, notified law enforcement, and deployed additional protection measures; services remain operational.

ATTACK CHAIN

This incident is a textbook illicit-consent-grant / third-party SaaS OAuth abuse chain. Step 1: attackers compromised Context.ai (an upstream SaaS used by a single Vercel employee); the scope of that breach is still under joint investigation. Step 2: the attacker abused the OAuth trust the employee had granted Context.ai in Google Workspace to take over the Google Workspace account. Vercel is publishing the specific malicious OAuth client ID — 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com — as an IOC so other Workspace administrators can hunt for it. Step 3: with Google-backed SSO access the attacker reached Vercel's production tenants, enumerated environments, and read environment variables not marked as 'sensitive.' Step 4: the attacker staged data (including internal Linear records used as proof of compromise) and, on 2026-04-19, listed the stolen material for sale on an underground hacking forum while simultaneously demanding a USD 2,000,000 extortion payment from Vercel.

DATA IMPACT — WHAT WAS AND WAS NOT EXPOSED

Exposed: environment variables that customers had NOT marked as 'sensitive' — which in practice commonly contain third-party API keys, database URLs, webhook signing keys, feature-flag tokens, and other secrets that developers treated as configuration. Also exposed: 580 Vercel employee records containing names, Vercel email addresses, account status and activity timestamps (published by the actor as a proof-of-breach sample). The actor further claims to hold NPM tokens, GitHub tokens, access keys, source code and database data.

NOT exposed (per Vercel's assessment as of 2026-04-20): environment variables marked 'sensitive' are stored in a form that prevents read access and Vercel states there is no evidence those values were accessed. Open-source projects maintained by Vercel — including Next.js and Turbopack — are confirmed unaffected. Only a 'limited subset' of customers had credentials exposed; those customers have been directly notified.

ATTRIBUTION

The actor is posting under the 'ShinyHunters' persona, but known ShinyHunters members have publicly denied involvement to reporters. The incident therefore appears to be the work of either a copycat, a loosely affiliated individual reusing the brand, or a distinct crew operating under the name. Vercel assesses the actor as 'highly sophisticated based on operational velocity and detailed understanding of Vercel's systems.' Motivation is financial, evidenced by the USD 2M ransom demand and the underground forum sale listing. Attribution confidence is LOW given the public dispute over actor identity.

DOWNSTREAM TENANT RISK

Vercel hosts a very large share of the Next.js, serverless and edge-deployed web, including major SaaS, e-commerce, media and cryptocurrency properties. Any tenant whose non-sensitive environment variables contained live secrets (third-party API keys, database credentials, webhook signing keys, crypto-project admin keys, etc.) must treat those secrets as compromised and rotate them immediately. Public reporting has specifically flagged crypto projects as exposed. Strategically the incident mirrors the Snowflake and prior SaaS-to-SaaS breach patterns: a single compromised upstream integration cascades into identity takeover and downstream tenant data exposure whenever OAuth application governance is weak.

## MITRE ATT&CK

- T1585.003 Establish Accounts: Cloud Accounts
- T1199 Trusted Relationship
- T1078.004 Valid Accounts: Cloud Accounts
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1098.001 Account Manipulation: Additional Cloud Credentials
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1526 Cloud Service Discovery
- T1087.004 Account Discovery: Cloud Account
- T1213 Data from Information Repositories
- T1213.003 Data from Information Repositories: Code Repositories
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1657 Financial Theft

## Sources

- [Vercel April 2026 Security Incident — Knowledge Base Bulletin](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)
- [Vercel confirms breach as hackers claim to be selling stolen data](https://www.bleepingcomputer.com/news/security/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/)
- [Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials](https://thehackernews.com/2026/04/vercel-breach-tied-to-context-ai-hack.html)
- [Vercel confirms security incident as hackers claim to sell internal access](https://cyberinsider.com/vercel-confirms-security-incident-as-hackers-claim-to-sell-internal-access/)
- [Vercel Confirmed Unauthorized Access to Its Internal Systems — $2M Ransom](https://webhosting.today/2026/04/19/vercel-confirmed-unauthorized-access-to-its-internal-systems-a-threat-actor-is-offering-the-stolen-data-for-2-million/)
- [Vercel Security Breach Raises Concerns for Crypto Projects](https://beincrypto.com/vercel-security-breach-internal-systems/)
- [Vercel Security Breach — Analysis](https://blog.rankiteo.com/ver1776623025-vercel-breach-april-2026/)
- [Google Workspace — OAuth app access control (Admin Help)](https://support.google.com/a/answer/7281227)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0394