Summary
Web scraping and automation platform Apify says an attacker accessed parts of its internal systems on November 9 and 10, 2026. The company detected the activity on November 11 at 12:13 UTC, cut off access and began an investigation.
Response
Apify has:
- Invalidated internal credentials
- Rotated API tokens and Apify Proxy passwords for impacted customers
- Reset all active sessions
- Revoked some OAuth connections to external integrations, including GitHub, as a precaution
Data Exposure
Messaging is mixed. One notification said Apify found no indication that account data on the platform was affected. A separate customer letter said 2FA codes may have been exposed, while passwords remain safe.
Not yet disclosed: how the attacker got in, how many customers are affected, and whether anything beyond 2FA codes was exposed.
What Customers Should Do
- Reset two-factor authentication in the Apify Console.
- Reconnect OAuth integrations such as GitHub only after Apify emails that it is safe.
- Replace any Apify API tokens and proxy passwords stored in scrapers, CI and automation, even if Apify already rotated them.
- Review run, actor and integration activity for unexpected changes since November 9.
- Audit what other secrets your actors hold (cloud keys, webhooks) and rotate any that were stored in Apify.