Coverage from Bleeping Computer indicates that the web scraping and browser automation platform Apify recently suffered a security breach involving unauthorized access to its internal systems.
The incident occurred between Nov. 9 and Nov. 10 and was identified by the company on Nov. 11 at 12:13 p.m. UTC. Upon discovery, Apify initiated an immediate response, which included invalidating internal credentials, rotating API tokens and resetting all active sessions. The company also revoked third-party OAuth connections to external services like GitHub as a precautionary measure. Apify, which serves 80,000 customers including major corporations like Microsoft and Samsung, stated that there is no current evidence that stored account data was compromised. However, the firm has advised affected users to reset their two-factor authentication codes, noting that these may have been exposed during the intrusion. Impacted customers are receiving direct notifications via email regarding the status of their API tokens and proxy passwords. This event highlights the ongoing security challenges faced by automation platforms as they manage sensitive integrations for a global client base. The company continues to investigate the full scope of the unauthorized access to ensure the integrity of its platform.
Source: Bleeping Computer
