Apify Breach Exposes 2FA Codes and GitHub Tokens
Czech web automation platform Apify confirmed that an attacker accessed some customer data on November 9 and 10, using a stolen credential to reach more systems and accounts.
⚡ Why it matters
The leaked data includes 2FA recovery codes and sign-in tokens, which can enable account takeover even when two-factor authentication is on. Apify users should act now.
Apify runs a cloud platform for web scraping and task automation and says it has 91,000 customers worldwide. The company said the intrusion happened on November 9 and 10 and was found on November 11, when it cut off the attacker and opened an investigation.
How it happened
The attacker used a compromised credential to obtain further credentials and then reached related Apify accounts. Apify said on November 12 that personal details or stored data belonging to some customers had been reached. It has not said how many accounts were hit.
What leaked
A customer notice shared on Reddit listed:
- Names, emails, billing details, IP addresses and account activity.
- Salted password hashes, 2FA recovery codes and phone numbers.
- Authentication tokens tied to Google and GitHub sign-in.
Card data was limited to cardholder name, expiry date and last four digits. Full card numbers and security codes were not exposed.
Apify's response
The company added monitoring, changed key internal secrets and cut some third-party OAuth links, including GitHub. Users who build Actors from private GitHub repositories were told to reconnect the integration.
What users should do
- Change your password and generate new 2FA recovery codes.
- Review authorized apps in your Google and GitHub accounts and remove anything unneeded.
- Rotate any API keys or secrets stored on the platform.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.