An email from Vercel came to my company at 10:47am UTC. It contained little information, and said:

> At this time, we do not have reason to believe that your Vercel credentials or personal data have been compromised.

Which is not very reassuring without actual information, since presumably they would have said the same thing on Saturday, if asked.