Apify, the web scraping and automation service provider, has verified that a recent cyberattack led to unauthorized access to customer data, affecting its internal systems and user accounts. This incident underscores the growing challenges companies face in securing sensitive information against cyber threats.
Details of the Breach
Based in the Czech Republic, Apify operates a cloud platform that facilitates the extraction of data from websites and automates online processes. The company boasts a global customer base of approximately 91,000 users. The security breach was initiated on November 9 and 10, with detection occurring on November 11. Upon discovery, Apify promptly blocked the attacker’s access and initiated a comprehensive investigation to assess the damage and prevent further intrusion.
The attacker reportedly exploited compromised credentials to acquire additional access, allowing them to infiltrate related accounts within Apify’s system. By November 12, Apify had acknowledged that personal information and stored data for some customers were accessed in the attack.
Customer Impact
In response, Apify has proactively reached out to customers whose data was potentially exposed. Those who have not received any communication are currently considered unaffected, although the investigation remains ongoing. The precise number of impacted accounts has not been disclosed by the company.
According to a customer breach notification shared on Reddit, the compromised data included personal identifiers such as names, email addresses, billing information, account activity, and IP addresses. Additionally, more sensitive information was affected, including salted password hashes, two-factor authentication (2FA) recovery codes, phone numbers, and authentication tokens linked to Google and GitHub logins.
Security Measures and Future Actions
Following the breach, Apify has taken steps to bolster its security framework. This includes enhanced monitoring, updating key internal credentials, and revoking specific OAuth connections to third-party services like GitHub. Importantly, while OAuth connections were not identified as an attack vector, Apify has advised customers using private GitHub repositories to re-establish their integrations.
These measures are part of Apify’s efforts to restore trust and ensure robust protection against future threats. As cyberattacks become increasingly sophisticated, companies like Apify continue to adapt their strategies to safeguard customer data and maintain service integrity.
