Apify breach: account credentials obtained and related accounts accessed; customers whose personal information or stored data was accessed have been notified
Apify says an attacker obtained account credentials on November 9-10, 2026, and has notified customers whose personal information or stored data was accessed.
What happened
Apify, the Czech web-scraping and browser-automation platform, says an unauthorised third party gained access to parts of its internal systems on November 9 and 10, 2026. The company detected the activity on November 11 at 12:13 UTC, cut off the access and opened an investigation that is still running. In an incident update on November 12, Apify confirmed the point its first notice had left open: the intruder used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. Apify says that access path is closed and that it has detected no further activity from the attacker since November 11. In a second update later on November 12, the company said it has notified the customers whose personal information or stored data was accessed in the incident, and that a customer who has not received an email has not been identified as affected so far. Apify has revoked some OAuth connections to external integrations, including GitHub, as a precaution — its investigation has not found that those connections could be used as an attack vector — rotated various critical internal secrets, and notified the relevant authorities.
Who is affected
The people affected are the Apify customers the company is notifying individually by email. Apify has not published how many accounts that is, and the figure of about 80,000 sometimes quoted with this incident is the platform’s total customer base, not an affected count. What the intruder reached, on the company’s own updates, is account credentials for a number of accounts and, for the notified customers, personal information or stored data. Customer notices seen by BleepingComputer add the operational detail: impacted customers’ Apify API tokens and Apify Proxy passwords have been rotated, and some customers have been advised to reset their two-factor authentication because their 2FA codes may have been exposed, while their passwords remain safe. One notice also said the company had found no indication that account data stored on the platform was affected; the notices describe different impacts for different customers, so the email a customer received — or did not receive — is the record for that account, not the general statements.
How serious
The concrete risk is account takeover. Working account credentials, API tokens and proxy passwords are the keys to an Apify account: whoever holds them can run tasks as the account holder, read stored data the account can reach, and spend the account’s balance on scraping work. A possibly exposed 2FA code narrows the second factor’s protection for the customers advised to reset it, which is why the reset advice matters more than the reassurance that passwords are safe. The revoked GitHub connections cut the other realistic path: an Apify account linked to private repositories could otherwise have been a stepping stone into code and the secrets stored with it, and Apify says it has found no sign that path was used. Nothing in the disclosure puts payment card data in the set, and no misuse of the taken credentials has been reported so far; the risk window is between the theft on November 9-10 and each customer completing the rotations and resets in their notice.
What to do now
If you use Apify, start with your inbox: if the company emailed you, follow that notice’s instructions exactly — they are account-specific. Reset your two-factor authentication in the Apify Console if your notice advises it, reconnect GitHub and other integrations only through the prompts and routes Apify itself gives, and treat any API token or proxy password that predates the rotation as retired. If you received no email, Apify’s position is that your account has not been identified as affected so far; even so, this is the moment to confirm 2FA is on and to review active sessions and tokens you no longer use. Do not act on messages about this incident that arrive outside Apify’s own notice and console — a breach that hands out real account details is exactly the material a follow-up phishing message is built from. If Apify publishes an affected count or its promised post-mortem, this report will be updated.
Sources: BleepingComputer, “Apify rotates API tokens, prompts 2FA resets after breach,” November 12, 2026 (reporting Apify’s November 11-12 incident updates and customer notices) · Abijita, “Apify confirms account credential theft after breach,” November 13, 2026