Apify, a Czech web scraping and automation company, confirmed that customer data was accessed during a cyberattack that compromised internal systems and customer accounts. The company operates a cloud platform for gathering information from websites and automating online tasks and says it serves 91,000 customers worldwide.
The intrusion occurred on November 9 and 10 and was discovered on November 11, when Apify cut off the attacker’s access and opened an investigation. According to the company, the attacker used a compromised credential to obtain further credentials and reach related Apify accounts. On November 12, Apify confirmed that some customers had personal information or stored data accessed.
Affected customers notified as inquiry continues
Apify has contacted the customers whose information was exposed. Customers who have not received a notification have not been identified as affected so far, though the company said its investigation is ongoing. Apify has not disclosed how many customer accounts were compromised.
A customer who posted a breach notification on Reddit said the exposed information included names, email addresses, billing details, account activity and IP addresses. The notification also listed salted password hashes, two-factor authentication recovery codes, phone numbers and authentication tokens tied to Google and GitHub sign-ins, according to the customer. Payment card data was limited to cardholder names, expiration dates and the last four digits of card numbers; full card numbers and security codes were not exposed.
Apify said it has added monitoring, changed critical internal secrets and revoked some OAuth connections to third-party services, including GitHub. The investigation has not found that those OAuth connections could have served as an attack vector, according to the company. Customers who build Apify Actors from private GitHub repositories have been told to reconnect their GitHub integrations.