Apify Confirms Customer Data Accessed in Cyberattack via Compromised Credentials
Apify, a Czech web scraping and automation platform with 91,000 customers globally, confirmed a cyberattack on November 9-10 that compromised internal systems and customer accounts through stolen credentials. The attacker leveraged a compromised credential to escalate access across multiple related accounts. Customer data exposed included personal information such as names, emails, billing details, IP addresses, salted password hashes, 2FA recovery codes, and authentication tokens linked to Google and GitHub logins. Payment card data exposure was limited to cardholder names, expiration dates, and partial card numbers; full card numbers and security codes were intact. Apify has revoked some OAuth tokens, changed critical internal secrets, and instructed affected customers to reconnect GitHub integrations. The investigation is ongoing, and Apify has notified affected customers but has not disclosed total affected account numbers. The breach highlights risks tied to credential compromise and third-party integrations in cloud platforms.
Linha do tempo
-
Apify Confirms Customer Data Accessed in Cyberattack via Compromised Credentials
ler a análise desta fonte ocultar
Apify, a Czech web scraping and automation platform with 91,000 customers globally, confirmed a cyberattack on November 9-10 that compromised internal systems and customer accounts through stolen credentials. The attacker leveraged a compromised credential to escalate access across multiple related accounts. Customer data exposed included personal information such as names, emails, billing details, IP addresses, salted password hashes, 2FA recovery codes, and authentication tokens linked to Google and GitHub logins. Payment card data exposure was limited to cardholder names, expiration dates, and partial card numbers; full card numbers and security codes were intact. Apify has revoked some OAuth tokens, changed critical internal secrets, and instructed affected customers to reconnect GitHub integrations. The investigation is ongoing, and Apify has notified affected customers but has not disclosed total affected account numbers. The breach highlights risks tied to credential compromise and third-party integrations in cloud platforms.