Apify Confirms Customer Data Access Following Recent Cyberattack

Web scraping and automation technology provider Apify has verified that unauthorized individuals successfully accessed customer accounts and internal environments during a recent security incident. The Czech enterprise, which operates a widely utilized cloud-based platform designed for harvesting online information and executing automated web tasks, serves an estimated 91,000 customers worldwide.

Incident Timeline and Discovery

According to formal disclosures issued by the organization, the malicious intrusion transpired across November 9 and November 10. Apify security teams identified the unauthorized activity on November 11, at which point the company moved quickly to block the perpetrator’s access channels and initiate a comprehensive forensic investigation into the breach.

Initial findings indicate that the malicious actor leveraged an initial compromised credential to escalate privileges, subsequently obtaining supplementary credentials that facilitated unauthorized entry into connected Apify accounts. By November 12, the firm confirmed that personal information and stored data belonging to specific customers had been successfully accessed. Impacted parties received direct notifications from the enterprise, while accounts lacking direct notification have not shown signs of exposure based on ongoing analytical reviews.

Exposed Data Categories

While Apify elected not to disclose the exact aggregate count of compromised customer accounts, third-party disclosures shared by affected users shed light on the nature of the exposed material. Customer notifications revealed that compromised datasets encompassed a range of sensitive records:

• User names and registered email addresses
• Billing information and associated account activity logs
• Network IP addresses linked to platform utilization
• Salted password hashes and authentication tokens tied to external identity providers
• Multi-factor authentication recovery phone numbers and codes

Significantly, financial records tied to payment cards remained strictly limited to cardholder names, expiration dates, and the final four digits of the primary card numbers. The breach did not expose full payment card numbers or internal security verification codes.

Mitigation and Remediation Measures

In response to the security event, Apify deployed enhanced system monitoring protocols, altered critical internal secrets, and actively revoked OAuth connections linking customer environments to third-party services such as GitHub. Although investigators found no concrete evidence indicating that external OAuth integrations served as the primary vector for the initial attack, the company strongly advised clients developing custom routines on private code repositories to re-establish their GitHub integrations securely.