Apify breach: unauthorized access to internal systems, API tokens and 2FA rotated
Severity: medium · Patch status: no-fix-needed · Since 2026-11-12
Apify, a Czech web scraping and browser automation platform with ~80,000 customers including Microsoft, Samsung, and Siemens, disclosed that an unauthorized third party gained access to parts of its internal systems on November 9-10, 2026, detected the following day. The company cut off attacker access, rotated customer API tokens and Apify Proxy passwords, reset all active sessions, and revoked OAuth connections to external integrations including GitHub. Impacted customers are advised to reset their two-factor authentication via the Apify Console, as 2FA codes may have been exposed, though passwords were not compromised. Apify says it found no indication that account data stored on the platform was affected. The investigation into impact is ongoing; affected users will be notified by email when it is safe to reconnect integrations.
What to do
- Rotate your Apify API token and Apify Proxy password if notified, and reconnect OAuth integrations (e.g., GitHub) only after Apify confirms it is safe
- Reset 2FA on your Apify account via the Apify Console
- Review Apify account activity and audit logs for unexpected runs, Actor changes, or data exports
- Check downstream systems that consumed Apify data or credentials for signs of misuse
- Monitor Apify's incident updates for findings from the ongoing investigation
Sources
All live incidents on Threat Watch
