[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPDOeA2nJ2fMqSUpZwdmjRxq2XhOfWf24KqpSjstfvSQ":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"dd59d6b6-3ebd-4a8e-b155-219ee273225f","Apify Confirms Customer Data Accessed in Cyberattack","apify-confirms-customer-data-accessed-in-cyberattack-854397","The web scraping company says an intruder accessed customer accounts and obtained personal information or stored data. The post Apify Confirms Customer Data Accessed in Cyberattack appeared first on SecurityWeek.","Web scraping company Apify confirmed a cyberattack on November 9-10 that compromised internal systems and customer accounts. An attacker used a stolen credential to gain further access, exposing customer personal information, stored data, salted password hashes, 2FA recovery codes, phone numbers, and authentication tokens. While full payment card numbers were not exposed, cardholder names and expiration dates were. Apify has contacted affected customers and implemented additional security measures.","Apify confirms customer data accessed in cyberattack via compromised credentials.","https:\u002F\u002Fwww.securityweek.com\u002Fapify-confirms-customer-data-accessed-in-cyberattack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002Fdata_breach.jpeg","2026-11-13T12:41:01+00:00","2026-11-13T13:00:03.99417+00:00",7,[17,20,23],{"name":18,"type":19},"Apify","vendor",{"name":21,"type":22},"web scraping","technology",{"name":24,"type":25},"Apify Actors","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,24],{"controls":47,"vendors":135},[48,77,106],{"slug":49,"name":50,"problem":51,"products":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":78,"name":79,"problem":80,"products":81},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":107,"name":108,"problem":109,"products":110},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":146},"stolen-credential-exposes-apify-customer-data-highlighting-mfa-and-secrets-management-gaps","Stolen Credential Exposes Apify Customer Data, Highlighting MFA and Secrets Management Gaps","An attacker used a single stolen credential to pivot through Apify's internal systems and access sensitive customer data, including authentication tokens, 2FA recovery codes, salted password hashes, and partial payment card details. This demonstrates how credential compromise becomes catastrophic when lateral movement is unconstrained and privileged access is not gated by strong multi-factor authentication. The exposure of 2FA recovery codes is particularly damaging because it undermines the very mechanism designed to compensate for stolen passwords. Storing authentication tokens and recovery codes alongside other account data creates a situation where one breach invalidates multiple layers of defense. Organizations must treat stored secrets and recovery materials with the same sensitivity as primary credentials.",[141,142,143,144,145],"NIST CSF 2.0 PR.AA-03: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(j)","NIS2 Article 21(2)(i)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 IA-5: Authenticator Management",{"NIS2 Article 21(2)(i)":147,"NIS2 Article 21(2)(j)":148,"CIS Control 6: Access Control Management (v8)":149,"NIST SP 800-53 IA-5: Authenticator Management":150,"NIST CSF 2.0 PR.AA-03: Identity Management, Authentication, and Access Control":151},"This point covers access control and asset management, requiring that human resources security and access policies ensure users only access what they need, which would have limited lateral movement after the credential was stolen.","This point mandates the use of multi-factor authentication and secured communications; enforcing MFA across all accounts would have prevented or significantly hindered the attacker's access even after credential theft.","CIS Control 6 requires managing access credentials and enforcing least-privilege, which would have constrained how much an attacker could access with a single compromised account.","IA-5 governs the secure management of authenticators including recovery codes and tokens, requiring they be protected in ways that would have prevented their bulk exposure alongside other account data.","This category requires that authentication and access control mechanisms prevent unauthorized access from compromised credentials, which would have limited the attacker's ability to pivot using a single stolen credential."]