Analysis: Vercel was attacked, suspected of having internal data stolen by well-known hackers claiming it could be used for global supply chain attacks

On April 19, according to a tweet of 23pds, chief information security officer of Slowfog Technology,"unauthorized access to the internal system of cloud hosting platform Vercel" was suspected to be related to internal data leakage. Previously, the account claiming to be a well-known hacker group ShinyHunters was selling Vercel's internal data for US$2 million. The content sold covered Vercel's internal database, access keys, source code, employee accounts (including internal deployment permissions), APIkeys, NPMtokens, GitHubtokens, etc., claiming to be used for global supply chain attacks (Vercel has Next.js, Turbo.js and other ecosystems, and Next.js has 6 million weekly downloads). The accompanying screenshots disclosed by the hackers show that the internal data package covers Vercel's internal Linear system and internal user management system. Previously, Vercel officials had contacted ShinyHunters on Telegram to stop harassing employees, which proved that Vercel was aware of the matter.