Apify confirms customer data viewed in November intrusion
Users who link GitHub to Apify must reconnect their accounts after tokens were revoked, and some stored data was viewed by the intruder.
Czech web scraping and automation firm Apify, which says it serves 91,000 customers, disclosed that an intruder reached internal systems and customer accounts during November 9 and 10 and was spotted on November 11, when access was cut off and an investigation began. The attacker reportedly used one stolen credential to harvest others and reach linked Apify accounts. On November 12 the company confirmed that some customers' personal details and stored data had been viewed, and it is notifying those affected while still probing the breach, without saying how many accounts were hit. A breach notice shared by a customer on Reddit lists names, emails, billing details, activity logs, IP addresses, salted password hashes, 2FA recovery codes, phone numbers and Google and GitHub sign-in tokens. Card data was limited to cardholder names, expiry dates and last four digits. Apify has rotated critical secrets, added monitoring, and revoked some third-party OAuth links, including GitHub, so users who build Actors from private repositories must reconnect them.
Why it matters
Customers of the scraping and automation platform now have to take action themselves: reconnect GitHub integrations and watch for misuse of exposed sign-in details, including 2FA recovery codes and phone numbers. Card exposure is limited to names, expiry dates and last four digits, which reduces payment risk. The company has not said how many accounts were affected, so the full scale of the breach remains unknown while the investigation continues.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.