Apify confirmed on November 12 that an intruder accessed some customers’ personal information or stored data, according to SecurityWeek. The web-scraping and browser-automation company hasn’t disclosed how many customer accounts were compromised, and its investigation continues. Source
The intrusion took place on November 9 and 10, 2026, and was discovered on November 11, when Apify blocked the attacker’s access and began investigating. According to the company’s explanation relayed by SecurityWeek, the attacker used a compromised credential to obtain additional credentials and access related Apify accounts. SecurityWeek does not explain how the first credential was compromised. Source
What the reported notification lists
SecurityWeek reports that a breach notification shared by an Apify customer on Reddit listed the following exposed data. It is not clear which categories applied to each affected account:
- Personal and account information: names, email addresses, billing details, account activity and IP addresses. Source
- Authentication information: salted password hashes, two-factor authentication (2FA) recovery codes and phone numbers, and authentication tokens associated with Google and GitHub sign-ins. Source
- Partial payment-card information: cardholder names, expiration dates and the last four digits of card numbers. According to that notice, full card numbers and security codes were not exposed. Source
Salted password hashes are representations generated from passwords and added random data; the notice does not establish that readable passwords were exposed. Recovery codes are backups for two-factor authentication, and sign-in tokens are digital credentials. Together, those entries make this more than a contact-list leak. Source
BleepingComputer also describes a customer notice saying there was no indication stored account data had been affected, and another assuring its recipients that their passwords remained safe. The reports do not give the notices’ issue times or establish whether the differences reflect separate customer groups or changing findings. Source Source
What Apify has changed—and told customers
BleepingComputer reports that Apify invalidated internal credentials, rotated API tokens and reset all active sessions. A notification sample seen by the outlet said affected customers’ Apify API tokens and Apify Proxy passwords had been rotated. API tokens are credentials software uses to access a service; Apify Proxy passwords are separate from account-login passwords. Source
In a separate notice, Apify told some recipients to reset two-factor authentication through the Apify Console because their 2FA codes may have been exposed. Source
Apify also added monitoring, changed critical internal secrets and revoked some third-party OAuth connections, including GitHub connections. Those connections give Apify permission to access external services. BleepingComputer described the revocations as precautionary. SecurityWeek reports that Apify’s investigation had not found that those connections could have served as an entry point for the attack. Revocation alone is not evidence that GitHub itself was breached. Source Source
Apify has contacted customers whose information was exposed, SecurityWeek reports. At the time of that report, customers without a notification had not been identified as affected, but the investigation was still underway. An empty inbox isn’t an all-clear. Source
Comments