Apify, a provider of a cloud platform specialized in web scraping and task automation, confirmed that its internal systems and some customer accounts were subject to a cyber breach. The attack occurred on November 9 and 10 and was discovered on November 11, prompting the company to immediately cut off the attacker's access and launch a comprehensive investigation.
The company explained that the attacker used compromised credentials to access additional accounts linked to the Apify platform. By November 12, the company confirmed that some customers' personal information or stored data had been subject to unauthorized access, and the company has already begun communicating with those affected.
Details of the Leaked Data
According to notices received by some customers, the accessed data included a set of sensitive information, which is:
- Names, email addresses, and phone numbers.
- Billing details, account activity logs, and IP addresses.
- Salted password hashes.
- 2FA recovery codes.
- Authentication tokens associated with Google and GitHub logins.
Regarding financial data, the leak was limited to cardholder names, expiration dates, and the last four digits of the cards only, without access to full numbers or security codes (CVV).
What Matters to Developers and Users?
The technical danger of this breach lies in the nature of the leaked data; obtaining 2FA recovery codes and access tokens may grant attackers the ability to bypass protection layers and attempt to access other linked accounts or services via OAuth techniques.
Regarding corrective measures, Apify provided specific instructions to developers using Apify Actors built from private GitHub repositories to re-link their GitHub integrations to ensure the security of their operations. The company also changed internal secrets and revoked some OAuth connections with external services to enhance protection and prevent any future exploitation.