The real risk here is not service downtime. It is that a cloud development platform with access to internal systems can expose customer secrets, source code, and deployment data even when the platform itself stays online.
Vercel says unauthorized access hit certain internal systems and affected a limited subset of customers. The company has brought in incident response help, notified law enforcement, and told customers to review environment variables and rotate secrets if needed. Attackers are also claiming to sell stolen data, including access keys, source code, database data, internal deployments, and API keys.
For practitioners, the important point is that a breach at a platform provider can turn into a secret-sprawl problem across customer environments. Even if Vercel’s service remains up, exposed credentials and deployment data can outlive the incident and widen the blast radius beyond the provider itself.