# SZB-92e20603fc: Apify reports unauthorized access to internal systems and rotates API tokens

Apify says an unauthorized third party gained access to parts of its internal systems on November 9 and 10, 2026, and it was detected the next day.

- Type: Breach
- Status: Confirmed
- Vendor: Apify
- Product: Apify platform
- Disclosed: 2026-11-12 14:36 UTC
- Data taken: Names, Email addresses, Password hashes, Tokens and keys, Phone numbers, Payment cards
- Way in: Stolen credentials (SecurityWeek: “According to the company, the attacker used a compromised credential to obtain additional credentials and gain access to related Apify accounts.”, [source](https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/))
- Sources: 6 distinct
- First seen by cve.now: 2026-11-12 14:38 UTC · Updated: 2026-11-13 12:45 UTC

Written by a model from the sources below. Verify against them.

## Summary

The company rotated internal secrets and customer API tokens and proxy passwords, revoked some OAuth connections including GitHub, and advised customers to reset their 2FA, though it found no indication that account data was affected.

## What to do

- Change your password there and anywhere you reused it, and turn on multi-factor authentication · For password hashes
- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys
- Watch your card and bank statements, and ask your bank for a new card · For payment cards
- Expect phishing that uses this breach; verify messages that mention it · For email addresses and phone numbers
- Rotate API tokens and reset two-factor authentication through the Apify Console.
- Reconnect OAuth integrations, including GitHub, only after Apify's email confirms it is safe.
- Check for and rotate any API tokens or proxy passwords that were issued before the rotation.
- Wait for Apify's notice before reconnecting third-party OAuth integrations.

## Timeline

- 2026-11-09: Attackers got in. BleepingComputer: “On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,” ([source](https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/))
- 2026-11-12 14:36 UTC: Made public by BleepingComputer
- 2026-11-12 14:38 UTC: First seen by cve.now
- 2026-11-13 12:41 UTC: Confirmed by Apify. SecurityWeek: “Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts.” ([source](https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/))
- 2026-11-13 12:45 UTC: Record last updated

## What was taken

- Names, Email addresses: [SecurityWeek](https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/): “According to an Apify customer who shared a breach notification on Reddit, the exposed information included names, email addresses, billing details, account activity, and IP addresses.”
- Password hashes, Tokens and keys, Phone numbers: [SecurityWeek](https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/): “More importantly, the notification listed salted password hashes, 2FA recovery codes and phone numbers, and authentication tokens associated with Google and GitHub sign-ins among the compromised data.”
- Payment cards: [SecurityWeek](https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/): “The notification also indicated that payment card information was limited to cardholder names, expiration dates, and the last four digits of card numbers.”

## Evidence (6 sources)

- 2026-11-12 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/): “On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3n24ozhtdgv2k))
- 2026-11-12 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3n24rqk5eqc27): “Apify, a Czech-based web scraping and browser automation platform, has suffered a security incident after an unauthorized third party gained access to parts…” (+6 more: [Bluesky](https://bsky.app/profile/hn100.bsky.social/post/3n256irbz6g2m), [Bluesky](https://bsky.app/profile/hnws.bsky.social/post/3n256s46ga52g), [Bluesky](https://bsky.app/profile/news.karthihegde.dev/post/3n257h2e2ds2f), [Bluesky](https://bsky.app/profile/hnbot.gsuscs.xyz/post/3n257xxn5i22w), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3n25e2utyg42n), [Bluesky](https://bsky.app/profile/paulannett.com/post/3n26vyzst2225))
- 2026-11-12 · Social · [Hacker News](https://news.ycombinator.com/item?id=50469708): “Apify: Security Breach” (+1 more: [Hacker News](https://news.ycombinator.com/item?id=50469719))
- 2026-11-12 · Social · [Reddit (r/netsec, r/cybersecurity, r/sysadmin)](https://www.reddit.com/r/cybersecurity/comments/1xuh7qh/apify_data_breach_unauthorized_access_to_user_pii/): “On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.”
- 2026-11-12 · Social · [Bluesky](https://bsky.app/profile/smtpedia.bsky.social/post/3n24vae7jsf26): “Apify confirms an attacker accessed customer emails, billing details and 2FA recovery codes on 9-10 November.”
- 2026-11-13 · Press · [SecurityWeek](https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/): “Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts.”

## Corrections

- 2026-11-12: Changed “Email addresses were exposed” to “Email addresses of customer emails were exposed”.
- 2026-11-12: Changed “Email addresses of customer emails were exposed” to “Email addresses were exposed”.
- 2026-11-12: Changed “Email addresses were exposed” to “Email addresses of customer were exposed”.
- 2026-11-13: Changed “Email addresses of customer were exposed” to “Email addresses were exposed”.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-92e20603fc&body=https%3A%2F%2Fcve.now%2FSZB-92e20603fc%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Apify breach

### Was Apify breached?

Yes. Apify says so: “Apify has confirmed that customer data was accessed in a cyberattack that compromised internal systems and customer accounts.” (SecurityWeek).

Source: https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/

### What data was exposed?

Names, Email addresses, Password hashes, Tokens and keys, Phone numbers, Payment cards.

### What should Apify customers do?

Change your password there and anywhere you reused it, and turn on multi-factor authentication. Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Watch your card and bank statements, and ask your bank for a new card. Expect phishing that uses this breach; verify messages that mention it. Rotate API tokens and reset two-factor authentication through the Apify Console. Reconnect OAuth integrations, including GitHub, only after Apify's email confirms it is safe. Check for and rotate any API tokens or proxy passwords that were issued before the rotation. Wait for Apify's notice before reconnecting third-party OAuth integrations.

## Related

- Started as early warning SZB-92e20603fc, first seen 2026-11-12 14:38 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-92e20603fc
Site guide for agents: https://cve.now/llms.txt