NewsPublished 13 Nov 2026

Apify Confirms Customer Data Accessed in Cyberattack

Source SecurityWeek

Description

Apify, a web scraping and automation company, suffered a cyberattack in November 2026 where an intruder accessed customer accounts and internal systems using compromised credentials. The attacker obtained personal information and stored data, including names, emails, billing details, salted password hashes, 2FA recovery codes, phone numbers, and authentication tokens. Payment card information exposure was limited to cardholder names, expiration dates, and last four digits, with no full card numbers or security codes accessed. Apify blocked the attacker, launched an investigation, notified affected customers, and implemented additional monitoring and security measures.

Impact

The breach exposed sensitive customer data including personal identifiers, authentication credentials, and partial payment card information. This exposure could facilitate account takeover, identity theft, and unauthorized access to customer accounts and services. However, full payment card numbers and security codes were not compromised, reducing the risk of direct financial fraud. The incident affects customer privacy and trust and may require affected customers to reset credentials and review account security.

Defensive guidance

Apify has blocked the attacker’s access, launched an investigation, notified affected customers, implemented additional monitoring, changed critical internal secrets, and revoked some OAuth connections to third-party services. Customers using private GitHub repositories for Apify Actors have been instructed to reconnect their GitHub integrations. No further immediate action is indicated beyond following Apify’s guidance and monitoring communications for updates.

Summary

In a cyberattack occurring on November 9-10, 2026, Apify's internal systems and customer accounts were compromised via a compromised credential that allowed the attacker to escalate access to related accounts. The attacker accessed personal and stored data of some customers, including sensitive authentication data such as salted password hashes, two-factor authentication recovery codes, and OAuth tokens linked to Google and GitHub sign-ins. Payment card data exposure was limited and did not include full card numbers or security codes. Apify responded by blocking access, notifying affected customers, revoking some OAuth connections, changing critical internal secrets, and enhancing monitoring. The investigation is ongoing, and no evidence was found that OAuth connections were the attack vector.

References

securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Nov 2026, 12:46 UTC

Technical details

References

Community reviews