Apify Gets Scraped: Hackers Swiped Customer Secrets After Credential Re-Use Blunder

Web scraping service Apify got a taste of its own medicine after a cyberattack gave hackers access to sensitive customer data. The Czech company, which boasts 91,000 customers, confirmed an intrusion on November 9th-10th, discovered only on the 11th. The attackers used a single compromised credential to hopscotch through internal systems and related accounts, exposing a data trove.

The breach exposed a developer's nightmare: salted password hashes, 2FA recovery codes, authentication tokens for services like GitHub, plus names, emails, and billing details. While Apify has revoked some OAuth connections and changed internal secrets, the core blunder—allowing credential reuse to cascade access—highlights a painful irony: a data extraction platform failing to secure its own vault. The takeaway? If your business is built on harvesting the web, maybe double-lock your own back door.