Apify Confirms Customer Data Breach, Resets Security Credentials And Revokes Third-Party Access

Czech web automation and data collection platform Apify has confirmed that hackers accessed customer accounts and sensitive information after compromising credentials used to enter its internal systems. The company has begun notifying affected customers and taking emergency measures to prevent further unauthorised access.

In its latest update on Thursday, Apify said it had contacted customers whose personal information or stored data was accessed during the incident. The company has also replaced sensitive security credentials and revoked connections to certain external services, including GitHub.

The intrusion occurred on November 9 and 10 and was detected on November 11. Although Apify says it has blocked the attacker’s access, the full extent of the breach remains under investigation.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

Compromised Credential Opens Door To Customer Accounts

Apify’s investigation found that an unauthorised party initially used a compromised credential to access parts of its systems.

The attacker subsequently obtained additional account credentials and accessed related customer accounts.

The company detected the suspicious activity at 12:13 UTC on November 11, equivalent to 5:43 PM Indian Standard Time. It then blocked the access route and began examining the affected systems.

Apify says it has not detected further activity by the attacker since November 11.

However, its investigation has not established publicly how the original credential was compromised or how many customer accounts were affected.

The company’s response has included invalidating internal credentials and resetting active sessions. Certain affected customers have also had their API tokens and proxy passwords replaced.

Apify confirmed that relevant authorities had been notified. It plans to publish a more detailed account of the incident after completing its remediation work.

Why The Breach Matters Beyond Apify

Apify provides software that helps businesses and developers collect information from websites and automate online activities.

Its platform is used for tasks such as gathering product information, monitoring search results and extracting publicly available online data.

The company reports serving approximately 80,000 customers, including major organisations such as Microsoft, Samsung, Siemens and Accenture.

However, this figure represents Apify’s overall customer base. It does not establish that 80,000 customers were affected by the breach.

The security implications are particularly important because automation platforms frequently connect with other business applications.

A developer may, for example, connect Apify to a private software project hosted on GitHub. Such connections allow authorised applications to perform tasks without requiring users to repeatedly enter passwords.

If the credentials supporting those connections are compromised, attackers may gain access to resources beyond the original platform, depending on the permissions granted.

Apify has revoked certain external connections as a precaution. The company says its investigation has not found that those connections provided a route for the attack.

What Are API Tokens, OAuth And Two-Factor Authentication?

Several security measures introduced after the breach involve technologies commonly used by developers but less familiar to ordinary internet users.

An API token is a digital credential that allows one application to communicate with another. It works like an electronic access key, enabling software to perform authorised tasks.

Replacing a potentially compromised token makes the old credential unusable once it is invalidated. Businesses must then update their applications with the replacement to restore normal operations.

OAuth is a system that allows users to authorise one service to access selected resources on another platform without directly sharing their account password.

Two-factor authentication, or 2FA, adds another layer of security to an account. It normally requires users to provide a second form of verification after entering their password.

According to customer notifications reviewed by cybersecurity publication BleepingComputer, some Apify users were advised to reset their two-factor authentication because associated authentication information may have been exposed.

The warning is significant because changing a password alone may not address every risk if other authentication credentials have also been compromised.

Earlier Breaches Highlight Risks Of Connected Applications

The incident follows earlier cybersecurity investigations that demonstrated the dangers associated with compromised application credentials.

In April 2022, GitHub disclosed that attackers had abused stolen OAuth tokens associated with Heroku and Travis CI to access private software repositories belonging to dozens of organisations.

GitHub said the tokens allowed attackers to obtain information from connected accounts without directly compromising GitHub’s own systems.

Heroku subsequently revoked affected connections, replaced credentials and introduced additional security measures following its investigation.

The Apify incident is separate, and there is currently no evidence linking the attackers to that earlier campaign.

For Apify customers, the immediate challenge is determining which accounts, applications and stored information require further security measures.

The company says customers who have not received notifications have not been identified as affected so far. However, additional users may be contacted if the continuing investigation uncovers further exposure.