Apify Confirms Cyberattack Exposure of Customer Data
A Czech web scraping and automation company, Apify, has confirmed that customer data was accessed in a recent cyberattack that compromised internal systems and customer accounts. The attack, which took place on November 9 and 10, exposed sensitive information for thousands of customers worldwide.
Apify provides a cloud platform that allows users to collect information from websites and automate online tasks. Its platform is used by over 91,000 customers globally, making the breach potentially far-reaching. The company’s investigation found that an attacker used a compromised credential to gain access to Apify accounts, ultimately exposing customer data.
According to a breach notification shared on Reddit by an Apify customer, the exposed information included names, email addresses, billing details, account activity, and IP addresses. More alarmingly, the notification listed salted password hashes, 2FA recovery codes, phone numbers, and authentication tokens associated with Google and GitHub sign-ins as compromised data.
Fortunately, payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers. However, customers should still be on high alert for potential phishing attempts or other malicious activities related to their exposed credentials.
Apify has taken steps to contain the breach by implementing additional monitoring, changing critical internal secrets, and revoking some OAuth connections to third-party services, including GitHub. Customers building Apify Actors from private GitHub repositories have been instructed to reconnect their GitHub integrations.
While Apify’s investigation found no evidence that the OAuth connections could be used as an attack vector, it is essential for customers to remain vigilant and report any suspicious activity immediately. This breach serves as a stark reminder of the importance of robust password management, multi-factor authentication, and regular security updates.
As cybersecurity threats continue to evolve, it is crucial for organizations and individuals alike to stay informed about potential vulnerabilities and take proactive measures to protect themselves from cyberattacks.
Source: SecurityWeek — 2026-11-13