Apify Confirms Customer Data Breach, Resets Security Credentials And Revokes Third-Party Access - The 420.in
Czech web automation platform Apify has confirmed a data breach after hackers accessed customer accounts through compromised credentials, with the company now resetting security measures and notifying affected users.
The company has begun notifying affected customers and taking emergency measures to prevent further unauthorized access. The intrusion occurred on November 9 and 10 and was detected on November 11 at 12:13 UTC (5:43 PM IST). Apify says it has blocked the attacker's access, but the full extent of the breach remains under investigation.
Compromised Credential Opens Door
Apify's investigation found that an unauthorized party initially used a compromised credential to access parts of its systems. The attacker subsequently obtained additional account credentials and accessed related customer accounts. The company has invalidated internal credentials and reset active sessions as part of its response.
Wider Security Implications
Apify serves approximately 80,000 customers, including major organizations such as Microsoft, Samsung, Siemens and Accenture. The security implications are particularly important because automation platforms frequently connect with other business applications through API tokens and OAuth connections.
Apify has revoked certain external connections as a precaution, though it states its investigation has not found that those connections provided a route for the attack. The company confirmed that relevant authorities had been notified and plans to publish a more detailed account after completing remediation work.
Related
