Apify rotates API tokens, prompts 2FA resets after breach
Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.
Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.
The incident occurred between November 9 and 10 and was detected the next day at 12:13 UTC; the company reacted by cutting off the attacker's access and launching an investigation to determine the impact.
Apify's response involved invalidating internal credentials, rotating API tokens, and resetting all active sessions.
The platform grew significantly with the generative AI boom, and reports having 80,000 customers, including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission, and Roche.
In one notification, Apify said it had found no indication that account data stored on its platform had been affected by the incident.
Businesses use its services to collect data for websites, search results, and social media posts, and impacted users can expect to be informed via email when it’s safe to reconnect.
A sample seen by BleepingComputer informs that impacted customers' Apify API tokens and Apify Proxy passwords have been rotated.
In another letter sent to affected customers, the company advises recipients to reset their two-factor authentication (2FA) through the Apify Console, warning that their 2FA codes may have been exposed while assuring them that their passwords remain safe.
Apify is a Czech web scraping and browser automation platform for developers; apify said it also revoked OAuth connections to external integrations, including GitHub, out of an abundance of caution.
What happened
Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.
The incident occurred between November 9 and 10 and was detected the next day at 12:13 UTC; the company reacted by cutting off the attacker's access and launching an investigation to determine the impact.
What changed
Apify's response involved invalidating internal credentials, rotating API tokens, and resetting all active sessions.
The platform grew significantly with the generative AI boom, and reports having 80,000 customers, including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission, and Roche.
In one notification, Apify said it had found no indication that account data stored on its platform had been affected by the incident.
Who is affected
Businesses use its services to collect data for websites, search results, and social media posts, and impacted users can expect to be informed via email when it’s safe to reconnect.
Why it matters
A sample seen by BleepingComputer informs that impacted customers' Apify API tokens and Apify Proxy passwords have been rotated.
In another letter sent to affected customers, the company advises recipients to reset their two-factor authentication (2FA) through the Apify Console, warning that their 2FA codes may have been exposed while assuring them that their passwords remain safe.
Technical details
Apify is a Czech web scraping and browser automation platform for developers; apify said it also revoked OAuth connections to external integrations, including GitHub, out of an abundance of caution.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.