Apify says an unauthorized third party used a compromised credential to obtain account credentials and access related Apify accounts during an incident on November 9 and 10. The developer platform detected the activity on November 11 at 12:13 UTC and cut off the access.
In its November 12 status updates, Apify said it had detected no further attacker activity since November 11 and had notified customers whose personal information or stored data was accessed. The company said it has not identified accounts as affected if their owners have not received an email notification so far.
Some customer notices reviewed by BleepingComputer said the company had rotated Apify API tokens and Apify Proxy passwords. Other notices asked customers to reset their two-factor authentication because their 2FA codes may have been exposed. Apify told those customers that their passwords remained safe, and one notification said the company had found no indication that account data stored on the platform was affected. The notices describe different customer-specific impacts, not a confirmed exposure affecting every account.
Apify said it revoked some OAuth connections to external integrations, including GitHub, as a precaution, but its investigation has not found that those connections were used as an attack path. The company also rotated critical internal secrets, notified relevant authorities and said it would publish a postmortem after remediation.
Its status page continues to list the security incident as unresolved and shows partial outages for the API and Actors services, although it does not say whether those service issues are connected to the breach. The company has not identified the compromised credential or provided a final count of affected users.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
