Apify Confirms Customer Data Was Accessed in Cyberattack

Apify, the Czech web scraping and automation platform, has disclosed that an intruder accessed customer accounts and could view personal information or stored data. The company says the breach occurred on 9–10 November and was detected on 11 November, after which it blocked the attacker and launched an investigation. The attacker reportedly used a compromised credential to obtain additional credentials and gain entry to related Apify accounts. By 12 November, Apify confirmed that some customers had their data accessed, though the number of affected accounts has not been disclosed.

According to a breached customer notification cited by SecurityWeek, the exposed data included names, email addresses, billing details, account activity and IP addresses. More sensitive items reportedly encompassed salted password hashes, 2FA recovery codes and phone numbers, as well as authentication tokens associated with Google and GitHub sign-ins. Payment card information was limited to cardholder names, expiry dates and the last four digits; full card numbers and security codes were not exposed.

In response, Apify has implemented additional monitoring, rotated critical internal secrets and revoked several OAuth connections to third‑party services, including GitHub. The company noted that its investigation had not found evidence that those OAuth connections could be used as an attack vector, though customers building Apify Actors from private GitHub repositories were advised to reconnect their GitHub integrations.