Web-scraping platform Apify breached via stolen credential; some customers' personal and stored data accessed

Apify says on its status page that on Nov 9-10 an unauthorized third party used a compromised credential to obtain account credentials and access related Apify accounts; it detected the activity on Nov 11 at 12:13 UTC, cut off access and has notified customers whose personal information or stored data was accessed ^[1]. SecurityWeek, citing a customer notification shared on Reddit, says exposed data included names, emails, billing details, account activity and IP addresses, plus salted password hashes, 2FA recovery codes and phone numbers, and Google and GitHub sign-in tokens; card data was limited to cardholder name, expiry date and last four digits ^[2]. What to do now: Apify says notified customers should follow the email's instructions, customers building Actors from private GitHub repos must reconnect GitHub, and other integrations should be reconnected if prompted ^[1].

Industries mainly affected: Technology

1. If you received an email from Apify, follow its instructions ^[1].
2. If you build Actors from private GitHub repos, reconnect GitHub (once per account and organization) .