Apify: a compromised credential let an intruder into internal systems and related customer accounts

How it happened

Apify says an unauthorised third party "used a compromised credential to obtain a number of account credentials and accessed related Apify accounts". It does not say which credential it was or how it was compromised. The access path is closed, and Apify has seen no activity from the attacker since November 11. It says the OAuth connections it revoked have not been found to be an attack vector.[1][2] Checked 13 Nov 2026

What was stolen

Apify says the personal information or stored data of some customers was accessed, with details in the email each of them received; it does not list the data types publicly. According to customer notices seen by BleepingComputer, API tokens and Apify Proxy passwords were rotated and customers were asked to reset two-factor authentication because their 2FA codes may have been exposed.[1][2] Checked 13 Nov 2026

Who was impacted

The Apify customers notified by email, whose personal information or stored data was accessed. Apify gives no number of affected customers.[1] Checked 13 Nov 2026

Threat actor

Not attributed

Timeline

1. 9 Nov 2026On November 9 and 10, an unauthorised third party accesses parts of Apify's internal systems and related customer accounts using a compromised credential. [1][2]
2. 11 Nov 2026Apify detects the activity at 12:13 UTC and cuts off access. As a precaution it rotates critical internal secrets, revokes some OAuth connections to external integrations and notifies the relevant authorities. It says it will rotate customers' tokens on their behalf if the investigation shows they were affected. [1]
3. 12 Nov 2026Apify says it has notified the customers whose personal information or stored data was accessed, and asks customers who build Actors from private GitHub repositories to reconnect GitHub. [1][2]