Apify Confirms Intruder Accessed Customer Accounts and Data

Czech web scraping and cloud automation provider Apify has confirmed a cyberattack on November 9 and 10 that compromised internal systems and customer accounts. Discovered and blocked on November 11, the intrusion exposed personal information and stored data belonging to an undisclosed number of Apify's 91,000 customers worldwide, confirmed by the company on November 12. With Apify serving 91,000 customers worldwide, organisations and developers in Malaysia using the platform should check for breach notifications and review connected accounts.

Key Facts

How Did the Apify Cyberattack Occur?

Apify stated that the attacker used a compromised credential to obtain additional credentials and gain access to related Apify accounts. The intrusion took place on November 9 and 10 before Apify detected the activity on November 11, blocked the intruder's access, and initiated an investigation into the incident.

Apify, a Czech company operating a cloud platform for collecting information from websites and automating online tasks, confirmed on November 12 that the attack compromised both internal systems and customer accounts. The company has contacted affected customers, while those who have not received a notification have not been identified as affected so far, though the investigation continues. Apify has not disclosed how many of its 91,000 customer accounts were compromised or attributed the intrusion to any threat actor.

The attacker gained access to Apify systems and related accounts on November 9 and 10 using a compromised credential before Apify blocked access on November 11.

What Customer Data Was Exposed in the Breach?

Apify confirmed that some customers had personal information or stored data accessed during the intrusion. According to a breach notification shared by an Apify customer on Reddit, exposed records included names, email addresses, billing details, account activity, IP addresses, salted password hashes, 2FA recovery codes, phone numbers, and sign-in authentication tokens.

The shared notification specified that the compromised authentication tokens were associated with Google and GitHub sign-ins. It also stated that exposed payment card details were limited to cardholder names, expiration dates, and the last four digits of card numbers, meaning full card numbers and security codes were not exposed.

A customer-shared breach notification listed salted password hashes, 2FA recovery codes, Google and GitHub sign-in tokens, and partial payment card details among the exposed data, excluding full card numbers and security codes.

What Mitigation Steps Has Apify Taken?

Following detection of the intrusion, Apify blocked the attacker's access on November 11, implemented additional monitoring, changed critical internal secrets, and revoked some OAuth connections to third-party services, including GitHub. The company also instructed customers building Apify Actors from private GitHub repositories to reconnect their GitHub integrations while its investigation continues.

Apify noted that its investigation had not found evidence that the OAuth connections could have been used as an attack vector. No client-side software update is mentioned for this cloud service incident, as remediation took place across Apify's internal environment and third-party integration tokens.

Apify rotated critical internal secrets, added monitoring, and revoked some third-party OAuth connections including GitHub, requiring affected Actor developers to reconnect private GitHub repositories.

What Should You Do?

• Check for an Apify breach notice: Review your account email for notifications from Apify; customers without a notice have not been identified as affected so far, though the investigation is ongoing.
• Reconnect GitHub integrations: If you build Apify Actors from private GitHub repositories, follow Apify's instruction to reconnect your GitHub integration after OAuth revocations.
• Reset credentials and tokens: Change your Apify password, update any reused passwords elsewhere, regenerate 2FA recovery codes, and review linked Google and GitHub sign-in sessions.
• Watch for phishing and scams: Be alert to unsolicited messages referencing your name, email address, billing details, or partial card information; users in Malaysia can report cyber incidents to Cyber999 (MyCERT) or suspected scams to the National Scam Response Centre on 997.

Common Questions

Were full payment card numbers exposed in the Apify breach?

No. According to the breach notification shared by an Apify customer on Reddit, exposed payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers. Full payment card numbers and security codes were not exposed during the attack.

How do I know if my Apify account was affected?

Apify stated that it has contacted customers whose information was exposed. Customers who have not received a notification have not been identified as affected so far, although Apify noted that its investigation is continuing and has not disclosed the total number of compromised customer accounts.

Did the attacker breach Apify through GitHub OAuth connections?

Apify stated that its investigation had not found that OAuth connections could have been used as an attack vector. Nevertheless, Apify revoked some OAuth connections to third-party services, including GitHub, and instructed customers building Apify Actors from private GitHub repositories to reconnect their GitHub integrations.

Sources and Methodology

This dispatch is based solely on reporting by SecurityWeek (no publication date is listed in the provided source text). No other documents, advisories, or vendor pages were reviewed, verified, or checked in preparing this summary.