Apify Says Attacker Accessed Customer Accounts and Data
Summary
Apify says an attacker used a compromised credential to access related customer accounts on Nov. 9–10. Some customers’ personal information or stored data was accessed; the company cut off access and rotated credentials and secrets.
Key points
- Apify says the intrusion occurred on Nov. 9–10 and was detected on Nov. 11, when it cut off access.
- According to Apify, the attacker used a compromised credential to obtain account credentials and access related customer accounts.
- Apify notified customers whose personal information or stored data it identified as accessed. It has not disclosed how many accounts were affected, how the initial credential was compromised, or who the attacker was.
- A customer-shared copy of a notice, reported by other outlets but not published or independently seen by Apify, lists possible exposure of contact and account details, billing information, salted password hashes, 2FA recovery codes, phone numbers, and Google and GitHub tokens.
- Apify says it revoked some OAuth connections and rotated critical internal secrets; the reported customer notice also says it rotated API tokens and proxy passwords, reset active sessions, and asked customers to reset 2FA.
- Apify datasets can contain scraped information about people, and the article says named storages are retained indefinitely unless removed.
Article Details
- Victim Organization
- Apify
- Incident Type
- Credential-based account intrusion and data breach. Apify said an attacker used a compromised credential to obtain account credentials and access related Apify accounts.
- Incident Date
- 2026-11-09
- Disclosure Date
- 2026-11-12
- Data Types Exposed
- Apify confirmed that some customers’ personal information or stored data was accessed, but did not specify the exact contents.
- A customer-shared notice, reported by SecurityWeek and not independently verified by the article, reportedly listed names, email addresses, IP addresses, account activity, billing details, salted password hashes, 2FA recovery codes, phone numbers, and tokens linked to Google and GitHub sign-ins.
- Affected Records
- Not disclosed; Apify did not say how many accounts were reached.
- Affected Data Size
- Not disclosed.
- Operational Impact
- The intrusion ran on 2026-11-09 and 2026-11-10. Apify detected it on 2026-11-11 at 12:13 UTC and cut off access. Apify said it revoked some OAuth connections, including GitHub connections, and rotated critical internal secrets. A customer notice reported by BleepingComputer said Apify also rotated customer API tokens and Apify Proxy passwords, reset active sessions, and requested 2FA resets.
- Ransom Or Extortion
- Unknown; the article does not describe ransom or extortion activity.
- Claim Status
- confirmed