Apify

Summary

Apify, a Czech web scraping and automation platform serving 91,000 customers worldwide, confirmed that customer data was accessed after an attacker used a compromised credential to obtain additional credentials and enter related accounts. The breach exposed names, email addresses, billing details, account activity, IP addresses, salted password hashes, two-factor authentication recovery codes, phone numbers, and Google and GitHub authentication tokens, while payment card details were limited to cardholder names, expiration dates, and last four digits. The company notified affected customers, implemented additional monitoring, changed critical internal secrets, and revoked certain OAuth connections to third-party services including GitHub, though it found no evidence those connections served as an attack vector and instructed users of private GitHub repositories to reconnect their integrations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Apify, a Czech web scraping and automation company that operates a cloud platform for collecting information from websites and automating online tasks, serves 91,000 customers worldwide. The company confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts. The intrusion occurred on November 9 and 10 and was discovered on November 11. Upon discovery, Apify blocked the attacker’s access and launched an investigation. According to the company, the attacker used a compromised credential to obtain additional credentials and gain access to related Apify accounts. On November 12, Apify confirmed that some customers had their personal information or stored data accessed during the attack. The company has contacted customers whose information was exposed. Customers who have not received a notification have not been identified as affected so far, although the investigation is continuing. Apify has not disclosed the number of compromised customer accounts.

A breach notification shared by an Apify customer on Reddit indicated that the exposed information included names, email addresses, billing details, account activity, and IP addresses. The notification also listed salted password hashes, two-factor authentication recovery codes and phone numbers, and authentication tokens associated with Google and GitHub sign-ins among the compromised data. Payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers. Full card numbers and security codes were not exposed. The company has implemented additional monitoring following the incident. Apify also changed critical internal secrets and revoked some OAuth connections to third-party services, including GitHub. The company stated that its investigation had not found that the OAuth connections could have been used as an attack vector. Customers building Apify Actors from private GitHub repositories have been instructed to reconnect their GitHub integrations.

Sources

Sources available to members: 1 source.