Skip to content
audiotale.net
Sign in
NewsNews

Apify breach: API tokens and Proxy passwords rotated, reset 2FA, reconnect GitHub

Apify says an attacker was inside its systems on 9-10 November 2026 and reached some customer accounts; here is what the company asks affected customers to do.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it works: why tokens, 2FA codes and OAuth links matter
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Apify, the Czech web-scraping and browser-automation platform, says an unauthorised third party was inside parts of its internal systems on 9 and 10 November 2026, and that some customers' accounts and stored data were accessed. The company has rotated API tokens and Apify Proxy passwords for affected customers, asked them to reset two-factor authentication, and revoked some OAuth connections, including GitHub. If you use Apify, the practical question is whether your account is on the affected list, and what to do either way.

Key points

  • Apify says the intrusion happened on 9 and 10 November 2026 and was detected on 11 November at 12:13 UTC; the attacker's access was cut off and Apify reports no further activity since 11 November.
  • On 12 November Apify said a compromised credential let the attacker obtain some account credentials and reach related accounts; it later said it had notified customers whose personal information or stored data was accessed.
  • Per BleepingComputer, affected customers' Apify API tokens and Apify Proxy passwords were rotated, and they were told to reset 2FA because 2FA codes may have been exposed (passwords were said to be safe).
  • Some OAuth connections, including GitHub, were revoked; customers who build Actors from private GitHub repositories must reconnect GitHub.
  • Customers who received no email from Apify have not been identified as affected so far, according to Apify's status page.

What to do

This section is practical. Apify's own instructions come first; the extra steps are our suggestions.

From Apify's status page (incident "Security incident"):

  • If you received an email from Apify, follow the instructions in it.
  • If you received no email, Apify says your account has not been identified as affected so far. It will contact any additional affected customers directly.
  • If you build Actors from private GitHub repositories, reconnect GitHub: open an Actor built from GitHub, select "Change provider", choose GitHub and authorise. Apify says you need to do this once per account and once per organisation.
  • If prompted, reconnect any other integrations, because some OAuth connections were revoked.

From BleepingComputer's reporting of the notification: if you are affected, your API tokens and Proxy passwords have already been rotated, so update them anywhere you use them (scripts, CI variables, secret stores, scheduled jobs). Reset 2FA through the Apify Console. Reports differ on reconnecting GitHub: BleepingComputer, citing a notification, said not to reconnect until Apify emails you, while the status page now gives the reconnection steps above. Follow the email you received, and otherwise the status page, which is the later and primary source.

Our own suggestions, not from Apify:

  • Even if you got no email, consider rotating your API token and Proxy password anyway. It costs a few minutes, and an Apify token usually sits in several places.
  • Review your Actors' environment variables, saved inputs and integrations for third-party secrets (cloud keys, database URLs, GitHub tokens). If your account was affected, treat those secrets as exposed and rotate them at the source.
  • Check recent runs and the account's activity for anything you did not start, and watch your billing for unexpected usage.
  • Be cautious with emails that claim to be from Apify about this incident: use the link on status.apify.com, not one in a message.

What happened

Apify's status page records the incident in three updates. The first, on 11 November at 20:46 CET, says an unauthorised third party gained access to parts of the company's internal systems on 9 and 10 November. Apify detected the activity on 11 November at 12:13 UTC, cut off access and began an investigation. It said it would contact affected users directly and had revoked some OAuth connections, including GitHub, as a precaution.

The second, on 12 November at 12:08 CET, adds the mechanism: a compromised credential let the attacker obtain some account credentials and access related accounts. Apify says the access path is closed and it has seen no attacker activity since 11 November. It said it was notifying affected users individually, had rotated various critical internal secrets, had notified the relevant authorities, and would publish a postmortem.

The third, at 17:16 CET the same day, says Apify has notified customers whose personal information or stored data was accessed, and that customers without an email have not been identified as affected so far. The next update was promised within 24 hours.

BleepingComputer, writing earlier on 12 November, quoted the company's statement that "On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify's internal systems", and reported that the company had found no sign that account data stored on the platform was affected. That is the main place where accounts differ in time: the later status-page updates say some customers' personal information or stored data was accessed. The likeliest explanation is that the investigation moved on between the two statements, but Apify has not said so, and we treat the later, primary statement as the current one.

Risky Bulletin's summary of the incident says hackers accessed customer accounts and that Apify suspects the OAuth connections it revoked were used to gain access; that detail is not in Apify's own updates that we read, so treat it as the newsletter's reading.

Background

Apify is a platform on which developers publish and run "Actors": containerised programs for scraping sites, driving browsers and automating workflows. BleepingComputer describes it as used for collecting data from websites, search results and social media, and reports that it has 80,000 customers, naming Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission and Roche among them. We have not been able to confirm the customer figure against an Apify page, so it is BleepingComputer's number.

A platform like this holds exactly the things attackers want from a developer tool: API tokens, proxy credentials, OAuth links to source-code hosts and, often, third-party secrets that customers place in Actor settings so their jobs can log in elsewhere. This is why breaches of developer platforms tend to spread outward. We reported the same pattern in October's Railway incident, where stolen environment variables led to unauthorised AI usage and in the Fireworks AI breach that reached developer machines through a cloud provider. The common lesson is that the credentials you give a platform are only as safe as the platform.

Each item Apify rotated or revoked closes a different door.

  • API tokens let a script act as your account without a password, so a stolen token works until it is revoked, whatever happens to your password and 2FA.
  • Proxy passwords authorise use of Apify's proxy network, which is billed to your account.
  • 2FA codes: Apify's warning that codes "may have been exposed", while passwords remain safe, is why a reset is requested: an authenticator secret that has leaked lets an attacker generate valid codes if they later obtain the password.
  • OAuth connections such as GitHub let Apify read the repositories you pointed it at. Revoking them stops any copy of those grants being used, and explains why private-repository Actors stop building until you reconnect.

What it means

For individual developers, the cost is an afternoon of housekeeping if you are affected and little if you are not. For teams, the larger risk is in the secrets stored inside Actors, which Apify has not said were or were not reached. For the industry, it is one more case in a month of developer-platform incidents; the longer-term fix is shorter-lived tokens and narrowly scoped OAuth grants, the same advice as in our guide to hardening GitHub Actions against stolen tokens.

What we don't know yet

  • How many customers were affected, and what exactly "personal information or stored data" covers. Apify has not published numbers.
  • Whether secrets stored in Actor settings or inputs were accessed.
  • How the first credential was compromised.
  • Who is behind the intrusion; Apify has not named anyone and we have seen no claim of responsibility.
  • Whether the incident is connected to others this month. We have seen no evidence that it is.

What to watch next

  • The next status-page update (promised within 24 hours of 12 November, 17:16 CET) and the postmortem Apify says it will publish.
  • Email from Apify if your account is added to the affected list.
  • Any further OAuth instructions for GitHub and other integrations.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next