Apify Confirms Customer Data Accessed in Cyberattack

An attacker used a single stolen credential to pivot through Apify's internal systems and access sensitive customer data, including authentication tokens, 2FA recovery codes, salted password hashes, and partial payment card details. This demonstrates how credential compromise becomes catastrophic when lateral movement is unconstrained and privileged access is not gated by strong multi-factor authentication. The exposure of 2FA recovery codes is particularly damaging because it undermines the very mechanism designed to compensate for stolen passwords. Storing authentication tokens and recovery codes alongside other account data creates a situation where one breach invalidates multiple layers of defense. Organizations must treat stored secrets and recovery materials with the same sensitivity as primary credentials.