Apify Rotates API Tokens After Unauthorized Access to Internal Systems
Summary
Apify says an unauthorized third party accessed parts of its internal systems on November 9–10, 2026. The company rotated tokens and reset sessions; it says 2FA codes may have been exposed but has found no indication account data was affected.
Key points
- Apify says an unauthorized third party accessed parts of its internal systems on November 9–10, 2026; the company detected the incident the following day.
- Apify cut off the attacker’s access, launched an investigation, invalidated internal credentials, rotated API tokens, and reset active sessions.
- The company revoked OAuth connections to external integrations, including GitHub, as a precaution.
- Affected customers were told their Apify API tokens and Apify Proxy passwords had been rotated.
- Some affected customers were advised to reset 2FA because their codes may have been exposed; Apify said their passwords remain safe.
- Apify said it had found no indication that account data stored on its platform was affected.
Article Details
- Victim Organization
- Apify
- Incident Type
- Unauthorized third-party access to parts of Apify's internal systems, occurring November 9–10, 2026.
- Incident Date
- 2026-11-09
- Data Types Exposed
- Apify API tokens
- Apify Proxy passwords
- Two-factor authentication codes (potentially exposed)
- Operational Impact
- Apify cut off the unauthorized access, invalidated internal credentials, rotated API tokens, reset active sessions, and revoked some third-party OAuth connections. The company said it found no indication that account data stored on its platform had been affected.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Vendors
Products
Apify Consolecustomers, the company advises recipients to reset their two-factor authentication (2FA) through the Apify Console, warning that their 2FA codes may have been exposed while assuring them that their passwords remainApify ProxyA sample seen by BleepingComputer informs that impacted customers' Apify API tokens and Apify Proxy passwords have been rotated.