Apify breach: stolen credentials used to access internal systems and customer data; OAuth tokens revoked, 2FA resets prompted
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:04; os links antigos trazem para cá.
Apify, a Czech web scraping and automation platform, disclosed a cyberattack on internal systems on November 9-10, 2026. The attacker used a compromised credential to escalate access across multiple related accounts (securityweek.com). The company says it detected the unauthorized access on November 11, then revoked third-party OAuth connections, rotated critical internal API tokens and secrets, reset all active sessions and prompted customers to reset two-factor authentication (2FA) codes (bleepingcomputer.com). The earliest report said no customer account data appeared to be compromised (bleepingcomputer.com). The later report on November 13 says customer data was accessed, including names, emails, billing details, IP addresses, salted password hashes, 2FA recovery codes, and authentication tokens linked to Google and GitHub logins (securityweek.com). The investigation is ongoing. Apify has notified affected customers but has not disclosed how many accounts are affected. Securityweek.com puts its customer base at 91,000 globally, and bleepingcomputer.com says it includes Microsoft and Samsung.
Detalhes técnicos
- Initial access was via a compromised credential, which the attacker used to escalate access across multiple related accounts (securityweek.com).
- The attacker had a roughly two-day window of access before detection (bleepingcomputer.com).
- Exposed customer data: names, emails, billing details, IP addresses, salted password hashes, 2FA recovery codes, and authentication tokens linked to Google and GitHub logins (securityweek.com).
- Payment card exposure was limited to cardholder names, expiration dates and partial card numbers. Securityweek.com says full card numbers and security codes were "intact", which we read as not exposed.
- Apify's response: revoking OAuth connections, rotating API tokens and Apify Proxy passwords, resetting all sessions, and changing critical internal secrets (bleepingcomputer.com, securityweek.com).
- Some OAuth integrations, including GitHub, were disabled temporarily. Affected customers were told to reconnect GitHub integrations (bleepingcomputer.com, securityweek.com).
Remediação
- Reset 2FA codes through Apify Console and watch for Apify communications about safely reconnecting OAuth integrations such as GitHub (bleepingcomputer.com).
- Monitor accounts closely, review integrations with Apify, and consider extra monitoring or temporary suspension until the risk is mitigated (bleepingcomputer.com).
- Given the reported exposure of salted password hashes and tokens tied to Google and GitHub logins, treat credentials and tokens linked to Apify as potentially exposed and rotate them. This is our inference from securityweek.com, not an Apify instruction.
Relatos divergentes
- Customer data impact: bleepingcomputer.com (November 12) said no customer account data stored on the platform appeared to be compromised. securityweek.com (November 13) confirms customer data was accessed. The later securityweek.com report should be treated as more current.
- Passwords: bleepingcomputer.com said password data remained uncompromised, while securityweek.com lists salted password hashes among the exposed data.
- Timing: bleepingcomputer.com's text is inconsistent on dates. It gives November 9-10 for the intrusion and November 11 for detection. Securityweek.com gives only November 9-10.
Linha do tempo
-
Apify Confirms Customer Data Accessed in Cyberattack via Compromised Credentials
ler a análise desta fonte ocultar
Apify, a Czech web scraping and automation platform with 91,000 customers globally, confirmed a cyberattack on November 9-10 that compromised internal systems and customer accounts through stolen credentials. The attacker leveraged a compromised credential to escalate access across multiple related accounts. Customer data exposed included personal information such as names, emails, billing details, IP addresses, salted password hashes, 2FA recovery codes, and authentication tokens linked to Google and GitHub logins. Payment card data exposure was limited to cardholder names, expiration dates, and partial card numbers; full card numbers and security codes were intact. Apify has revoked some OAuth tokens, changed critical internal secrets, and instructed affected customers to reconnect GitHub integrations. The investigation is ongoing, and Apify has notified affected customers but has not disclosed total affected account numbers. The breach highlights risks tied to credential compromise and third-party integrations in cloud platforms.
-
Apify breach prompts API token rotation and 2FA resets after unauthorized internal system access
ler a análise desta fonte ocultar
On November 9-10, 2026, Apify, a Czech web scraping and automation platform, detected unauthorized access to parts of its internal systems on November 11. The company immediately revoked third-party OAuth connections, rotated critical internal API tokens, reset all active sessions, and prompted customers to reset two-factor authentication (2FA) codes as a precaution. Apify stated that no customer account data stored on the platform appears to have been compromised. Some OAuth integrations, including GitHub, were disabled temporarily pending safe reconnection notice. This incident affects a broad user base including Microsoft and Samsung, highlighting risks in cloud-based automation services.
Technical Details
The attacker accessed internal systems during a two-day window before detection. Apify's response included revoking OAuth connections and rotating API tokens and Apify Proxy passwords. The reset of active sessions ensures immediate invalidation of existing authenticated sessions. Customers were advised to reset 2FA codes through Apify Console due to possible exposure, though password data remains uncompromised.
Remediation
Apify users are recommended to check communications for details on OAuth reconnections, reset their 2FA codes, and monitor their accounts closely. Organizations should review integrations with Apify and consider additional monitoring or temporary suspension until the incident risk is mitigated.