What Apify says happened
Apify's status page says an unauthorized third party gained access to parts of its internal systems on 9 and 10 November 2026. The company detected the activity on 11 November at 12:13 UTC, cut off access and began an investigation. It says it has prevented further unauthorized access and added monitoring.
A later status update, posted 12 November, added detail on the attack path:
- The attacker used a compromised credential to obtain a number of account credentials, then accessed related Apify accounts.
- Apify says that access path is now closed. It says it has detected no further attacker activity since 11 November.
- It is notifying affected users individually, has notified the relevant authorities, and promises a post-mortem after remediation.
Several things remain unknown. Apify has not said which credential was compromised, how many accounts were involved, or exactly what data was accessed. The investigation is still open, and the status page lists the incident as unresolved.
What was rotated or revoked
Apify says it rotated "various critical internal secrets" and revoked some OAuth connections to external integrations as a precaution. The revoked connections include GitHub. Affected users of other integrations will be prompted by a separate email to reconnect. Apify says its investigation has not found that these connections could serve as an attack vector.
BleepingComputer reports on customer notifications it saw:
- One sample said affected customers' Apify API tokens and Apify Proxy passwords had been rotated.
- Another told recipients to reset 2FA through the Apify Console. It warned that their 2FA codes may have been exposed, and said their passwords remained safe.
- One notification said Apify had found no indication that account data stored on the platform was affected.
Public statement versus customer emails
The public and private messages describe different scopes, so read them carefully.
- Status page, 11 November: Apify said that if its investigation showed your tokens were affected, it would rotate them on your behalf and notify you. That is conditional and per-account.
- BleepingComputer's customer emails: these say tokens and proxy passwords were rotated for the affected recipients. The 2FA reset request applies to whoever received that notice.
- Community reports: a DEV Community post from one developer says Apify told account holders it had rotated all API tokens and Proxy passwords, ended sessions and revoked GitHub sign-in. That is a single user's account, not an Apify statement. It does suggest the rotation hit many accounts, and it describes real breakage when old tokens died.
Don't assume your account was or wasn't touched. Rely on the email sent to your account's address and on whatever your Console shows.
Operational snapshot
At the time of the status page capture, Apify listed its API and Actors as having partial outages. The Console, storage, proxy, scheduler, webhooks and several other components showed as operational. That is a point-in-time snapshot. It doesn't prove the incident caused the outages.
What Apify users should do
Apify's published guidance is short. The steps below combine it with ordinary credential hygiene.
- Check the inbox tied to your Apify account. Follow the instructions in any email from Apify, and treat unsolicited links with suspicion. Phishing that imitates a breach notice is a predictable follow-on.
- Reset 2FA in the Apify Console if you were told to. The sources don't give exact menu paths, so navigate from the Console's account security settings rather than from email links.
- Replace rotated credentials everywhere they live. Old tokens stop working, which in practice means 401 errors. Check:
- CI/CD secrets, such as GitHub Actions secrets or deployment environment variables
- cron jobs and scripts
- webhook receivers
- scheduled tasks and no-code automation connections
- the Apify CLI, which may need you to sign in again (reported by the DEV post's author)
- any scraper using Apify Proxy credentials
- Reconnect GitHub if you build Actors from private repositories. Apify's steps: open an Actor built from GitHub, choose "Change provider", pick GitHub, and authorize. Apify says this is needed once per account and once per organization.
- Reconnect other integrations only when prompted.
- Audit recent activity. Look at the run history for Actors or tasks you don't recognize, and at billing for unexpected compute or proxy usage. Third-party guidance on rotating a compromised Apify token recommends the same checks. That guidance isn't Apify's own incident advice.
Why this matters beyond Apify
BleepingComputer notes that Apify grew with the generative-AI boom and reports 80,000 customers. It names Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission and Roche among them. That list is customer context only. Nothing reported says Microsoft systems or data were affected.
The practical lesson for Windows and .NET shops is about where tokens sit. A scraping or automation token usually ends up in a script, a build pipeline or an environment variable. Apify's own API docs say a token in an Authorization header is safer than one in a URL query string, because URLs are stored in browser history and server logs. That is the safer of the two ways to send it. If you've been passing tokens as URL parameters, this incident is a reason to stop.
Two further points are general security practice, not claims from Apify's notices:
- Keep a documented rotation procedure, so a forced rotation is an inconvenience rather than an outage.
- Prefer scoped credentials where a platform offers them. Apify's docs describe scoped tokens with limited permissions.
The bottom line
Apify's story is a familiar one. An attacker used one compromised credential to harvest others, and the vendor responded with rotation, session resets and OAuth revocations. The company's updates have been fairly prompt, but the key facts are still missing: the number of accounts, the data accessed and the root cause. Until the post-mortem arrives, treat your Apify credentials as burned, update them, and watch your logs.