Vercel Discovers Compromised Accounts Linked to Context.ai Data Breach

A security incident was discovered on April 23, 2026, where a Vercel employee's compromised Google Workspace account enabled unauthorized access to their Vercel account and subsequently allowed the attacker to pivot into a Vercel environment. The breach originated with a compromise of [IOC HIDDEN • LOGIN REQUIRED], which was used by the Vercel employee, potentially as a result of social engineering or malware. An additional set of customer accounts were later found to be compromised, with evidence of prior compromise independent of this incident, possibly due to social engineering, malware, or other methods. The attackers' velocity and ability to enumerate internal environments before detection changed the job for defenders from prevention to rapid scoping and blast-radius reduction.