Summary

• The dominant event is a Vercel breach linked to compromise of the Context.ai third-party AI tool.
• Attackers used OAuth and Google Workspace account access to move from the vendor compromise into Vercel internal systems.
• Reporting consistently distinguishes between encrypted sensitive variables and unencrypted or non-sensitive environment variables that may have been exposed.
• Customer impact appears limited but not fully settled; some accounts or credentials were affected, while the full scope remains under investigation.
• The incident is being framed as an identity and access control failure as much as a classic software breach.
• Response actions are consistent across reports: incident response, law enforcement notification, customer alerts, and credential rotation guidance.
• Later reporting adds uncertainty about whether the compromise began earlier than first disclosed and whether more customer data was taken.