Apify Confirms Customer Data Accessed in Cyberattack

Summary

Apify says an attacker used a compromised credential to access related accounts on Nov. 9–10. Customer data, including salted password hashes and authentication tokens, was accessed; the investigation continues.

Key points

Apify says the intrusion occurred Nov. 9–10 and was discovered on Nov. 11, when it blocked the attacker’s access.
The attacker reportedly used a compromised credential to obtain additional credentials and access related Apify accounts.
Apify confirmed some customer personal information or stored data was accessed; it has not disclosed the number of affected accounts.
A customer-shared breach notification listed names, email addresses, billing details, account activity, IP addresses, salted password hashes, 2FA recovery codes, phone numbers, and Google and GitHub authentication tokens.
The notification said exposed payment-card details were limited to cardholder names, expiration dates, and the last four digits; full card numbers and security codes were not exposed.
Apify says it contacted customers whose information was exposed, changed critical internal secrets, increased monitoring, and revoked some OAuth connections.
Apify said its investigation had not found that OAuth connections were an attack vector; customers using private GitHub repositories to build Actors were told to reconnect their integrations.

Article Details

Victim Organization: Apify
Incident Type: Cyberattack involving compromised credentials and unauthorized access to internal systems, customer accounts, and customer data
Data Types Exposed: Names
Email addresses
Billing details
Account activity
IP addresses
Salted password hashes
Two-factor authentication recovery codes
Phone numbers
Authentication tokens associated with Google and GitHub sign-ins
Payment cardholder names
Payment card expiration dates
Last four digits of payment card numbers
Affected Records: Not disclosed; Apify had not disclosed the number of compromised customer accounts.
Affected Data Size: Not disclosed
Operational Impact: The attacker accessed internal systems and related Apify customer accounts. Apify blocked the attacker’s access, investigated, added monitoring, changed critical internal secrets, and revoked some OAuth connections. Customers using private GitHub repositories to build Apify Actors were instructed to reconnect their GitHub integrations. Full payment card numbers and security codes were not exposed.
Ransom Or Extortion: Unknown
Claim Status: confirmed