Apify breach exposes customer data and 2FA recovery codes

Apify, a Czech web scraping and automation platform, disclosed a security breach after an intruder used a compromised credential to access internal systems and then reach linked customer accounts on November 9 and 10. The company detected the intrusion on November 11, cut off the attacker's access, and its investigation remains ongoing. On November 12 it confirmed that some customers' personal information and stored platform data had been accessed, with SecurityWeek reporting about 91,000 customers worldwide. Exposed data reportedly included names, email addresses, billing details, IP addresses, salted password hashes, phone numbers, and two-factor recovery codes, along with authentication tokens linked to Google and GitHub logins. In response, Apify invalidated internal credentials and API tokens, reset active sessions, and asked affected customers to redo their two-factor authentication setup.