Apify Confirms Customer Data Accessed in Cyberattack
Web scraping and automation company Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts on November 9-10.
The intrusion took place on November 9 and 10 and was discovered on November 11, when Apify blocked the attacker's access and launched an investigation. According to the company, the attacker used a compromised credential to obtain additional credentials and gain access to related Apify accounts.
On November 12, Apify confirmed that some customers had their personal information or stored data accessed during the attack. The company has contacted customers whose information was exposed, though it has not disclosed the number of compromised accounts.
Exposed Information
According to an Apify customer who shared a breach notification on Reddit, the exposed information included names, email addresses, billing details, account activity, and IP addresses. More critically, the notification listed salted password hashes, 2FA recovery codes and phone numbers, and authentication tokens associated with Google and GitHub sign-ins among the compromised data.
The notification also indicated that payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers. Full card numbers and security codes were not exposed.
Security Response
Customers building Apify Actors from private GitHub repositories have been instructed to reconnect their GitHub integrations.
Apify has implemented additional monitoring, changed critical internal secrets, and revoked some OAuth connections to third-party services, including GitHub. The company stated its investigation had not found that the OAuth connections could have been used as an attack vector.
Related
