Breach
Apify reports unauthorized access to internal systems and rotates API tokens
Apify says an unauthorized third party gained access to parts of its internal systems on November 9 and 10, 2026, and it was detected the next day.
Written by a model from the sources below. Verify against them.
- Vendor
- Apify
- Product
- Apify platform
- Status
- Confirmed
- Disclosed
- Data taken
- Names, Email addresses, Password hashes, Tokens and keys, Phone numbers, Payment cards
- SecurityWeek: “According to the company, the attacker used a compromised credential to obtain additional credentials and gain access to related Apify accounts.”
- Stolen credentials
Summary
The company rotated internal secrets and customer API tokens and proxy passwords, revoked some OAuth connections including GitHub, and advised customers to reset their 2FA, though it found no indication that account data was affected.
What to do
Change your password there and anywhere you reused it, and turn on multi-factor authentication
For password hashesRotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it
For tokens and keysWatch your card and bank statements, and ask your bank for a new card
For payment cardsExpect phishing that uses this breach; verify messages that mention it
For email addresses and phone numbersRotate API tokens and reset two-factor authentication through the Apify Console.
Reconnect OAuth integrations, including GitHub, only after Apify's email confirms it is safe.
Check for and rotate any API tokens or proxy passwords that were issued before the rotation.
Wait for Apify's notice before reconnecting third-party OAuth integrations.
Timeline
- Attackers got in
BleepingComputer: “On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,”
3 days - Made public by BleepingComputer
- First seen by cve.now1 day
- Confirmed by Apify
SecurityWeek: “Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts.”
- Record last updated
What was taken
| Taken | Per the source |
|---|---|
| Names, Email addresses | SecurityWeek: “According to an Apify customer who shared a breach notification on Reddit, the exposed information included names, email addresses, billing details, account ac…” |
| Password hashes, Tokens and keys, Phone numbers | SecurityWeek: “More importantly, the notification listed salted password hashes, 2FA recovery codes and phone numbers, and authentication tokens associated with Google and Gi…” |
| Payment cards | SecurityWeek: “The notification also indicated that payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers.” |
Evidence 6
- PressBleepingComputer
“On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,”
+1 more: BleepingComputer on Bluesky - Social
- Social
- SocialReddit (r/netsec, r/cybersecurity, r/sysadmin)
“On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.”
- SocialBluesky
“Apify confirms an attacker accessed customer emails, billing details and 2FA recovery codes on 9-10 November.”
- PressSecurityWeek
“Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts.”
Corrections
- Changed “Email addresses were exposed” to “Email addresses of customer emails were exposed”.
- Changed “Email addresses of customer emails were exposed” to “Email addresses were exposed”.
- Changed “Email addresses were exposed” to “Email addresses of customer were exposed”.
- Changed “Email addresses of customer were exposed” to “Email addresses were exposed”.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Apify breach
Was Apify breached?
Yes. Apify says so: “Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts.” (SecurityWeek).
What data was exposed?
Names, Email addresses, Password hashes, Tokens and keys, Phone numbers, Payment cards.
What should Apify customers do?
Change your password there and anywhere you reused it, and turn on multi-factor authentication. Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Watch your card and bank statements, and ask your bank for a new card. Expect phishing that uses this breach; verify messages that mention it. Rotate API tokens and reset two-factor authentication through the Apify Console. Reconnect OAuth integrations, including GitHub, only after Apify's email confirms it is safe. Check for and rotate any API tokens or proxy passwords that were issued before the rotation. Wait for Apify's notice before reconnecting third-party OAuth integrations.