How the Breach Occurred

Between November 9 and 10, 2026, Apify, a platform used for web scraping and browser automation by numerous businesses, detected unauthorized access to its internal systems. The company identified the intrusion on November 10th and promptly initiated an investigation. As a precautionary measure, Apify responded by rotating internal API tokens, revoking OAuth connections to third-party services like GitHub, and invalidating active sessions to cut off the attacker's access.

What Data Was Exposed & Consumer Risks

  • While Apify stated that no account data stored on its platform was directly affected, the breach involved unauthorized access to internal systems. This could potentially expose sensitive operational information.
  • Affected customers were notified that their Apify API tokens and Apify Proxy passwords may have been compromised. These credentials are vital for accessing and managing services on the platform.
  • Users were also advised to reset their two-factor authentication (2FA) codes, indicating a potential exposure of 2FA-related information, even though passwords were not reported as compromised.

Protective Steps for Affected Consumers

Given the nature of the breach, Apify users should take immediate steps to secure their accounts and associated data. The company has already initiated some measures, but user vigilance is crucial.

  • Immediately reset your Apify API tokens and any associated passwords. Ensure you generate new, strong, and unique tokens.
  • Reset your two-factor authentication (2FA) for your Apify account. Follow Apify's instructions to reconfigure your 2FA settings.
  • If you had previously connected third-party services (like GitHub) via OAuth, be prepared to re-authenticate and review those connections. Apify has revoked some of these, and you may need to re-establish them securely.
  • Monitor your Apify account activity for any suspicious actions or unauthorized access attempts. Change your Apify account password if you have any doubts about its security.
  • Be cautious of any phishing attempts that may leverage information from this breach. Scammers might try to impersonate Apify or other services to trick you into revealing more sensitive information.