Apify Says Customer Data Was Accessed in November Cyberattack
Apify says an attacker accessed customer information and stored data during a cyberattack that compromised the company’s internal systems and customer accounts. The Czech web-scraping and automation provider said the intrusion occurred on November 9 and 10, was detected on November 11, and was contained after the company blocked the attacker’s access.
The incident raises vendor-risk questions for organizations that rely on Apify’s cloud platform or connect it to other services. Apify has not disclosed how many customer accounts were compromised. The company said it contacted customers whose information was exposed, while cautioning that its investigation is ongoing and that customers who have not received a notification have not been identified as affected so far.
Credential compromise enabled access to related accounts
Apify said the attacker began with a compromised credential, then obtained additional credentials and accessed related Apify accounts. The company has not provided further technical details about the initial credential compromise or the specific route used to obtain subsequent credentials.
Apify discovered the intrusion on November 11 and said it blocked the attacker’s access that day before beginning an investigation. On November 12, the company confirmed that some customers’ personal information or stored data had been accessed. It has not publicly stated the total number of affected customers or accounts.
A customer-shared breach notification described a range of potentially exposed information. The listed data included names, email addresses, billing details, account activity and IP addresses. It also listed salted password hashes, two-factor authentication recovery codes, phone numbers and authentication tokens associated with Google and GitHub sign-ins.
The notification said payment-card exposure was limited to cardholder names, expiration dates and the last four digits of card numbers. Full card numbers and card security codes were not exposed, according to that notice. Apify has not disclosed how many customers had each category of information accessed.
Apify changes secrets and revokes some connections
Apify said it has added monitoring, changed critical internal secrets and revoked some OAuth connections to third-party services, including GitHub. The company said its investigation had not found that the OAuth connections could have been used as an attack vector. That assessment is limited to the investigation’s findings at the time of the announcement; the company said its inquiry was continuing.
Customers who build Apify Actors using private GitHub repositories were instructed to reconnect their GitHub integrations. This is a direct operational step for users whose development workflows depend on those connections. Organizations should also establish whether affected accounts or integrations are used in business-critical automation and review relevant access in line with their own incident-response procedures.
The reported presence of authentication tokens and two-factor recovery codes in the exposed information makes account and integration review particularly relevant for notified customers. They should follow Apify’s instructions and assess credentials and connections associated with the affected accounts. The source of the initial compromised credential has not been identified publicly, and no specific exploitation technique or broader campaign has been attributed to the incident.
Customer notification and continuing investigation
Apify describes itself as a cloud platform for collecting information from websites and automating online tasks, and says it has 91,000 customers worldwide. The company has not said how many of those customers were affected. The number of accounts involved, the duration of unauthorized access beyond the November 9–10 intrusion window, and the full scope of accessed stored data have not been disclosed.
For enterprise buyers and security teams, the incident underscores the importance of understanding what data and authentication material a service provider may hold, as well as which third-party integrations are connected to it. Customers should use the provider’s notification as the basis for determining whether their organization was affected, rather than treating the absence of a notification as confirmation that the investigation is complete. Apify has said customers who have not been contacted have not been identified as affected so far, while its investigation continues.
Apify’s response measures include blocking the attacker, adding monitoring, changing critical internal secrets and revoking some third-party OAuth connections. The company has not reported a final account count or completed the public account of the incident. Further information from the ongoing investigation could clarify the scale of exposure and whether additional customer actions are needed.
