Web scraping and automation company Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts. The Czech company provides a cloud platform for collecting information from websites and automating online tasks. It says it has 91,000 customers worldwide.
The intrusion took place on November 9 and 10 and was discovered on November 11, when Apify blocked the attacker’s access and launched an investigation. According to the company, the attacker used a compromised credential to obtain additional credentials and gain access to related Apify accounts.
On November 12, Apify confirmed that some customers had their personal information or stored data accessed during the attack. The company has contacted customers whose information was exposed. Those who have not received a notification have not been identified as affected so far, although the investigation is continuing. Apify has not disclosed the number of compromised customer accounts.
According to an Apify customer who shared a breach notification on Reddit, the exposed information included names, email addresses, billing details, account activity, and IP addresses. More importantly, the notification listed salted password hashes, 2FA recovery codes and phone numbers, and authentication tokens associated with Google and GitHub sign-ins among the compromised data.
The notification also indicated that payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers. Full card numbers and security codes were not exposed. The company has implemented additional monitoring, changed critical internal secrets, and revoked some OAuth connections to third-party services, including GitHub. Apify said its investigation had not found that the OAuth connections could have been used as an attack vector. Customers building Apify Actors from private GitHub repositories have been instructed to reconnect their GitHub integrations.
