Apify breach: one stolen credential cascaded into customer accounts

Web-scraping and automation platform Apify says an unauthorized third party used a single compromised credential to obtain more credentials and reach customer accounts over 9–10 November 2026. Per Apify's incident notice, the company detected the activity on 11 November at 12:13 UTC, cut off access, and has seen no further attacker activity since. If you run Apify Actors in production or wired Apify into CI, rotate its tokens and tighten storage access today.

What Apify confirms

In its own words, "on 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify's internal systems," using a compromised credential to obtain "a number of account credentials and accessed related Apify accounts." Apify says it has notified the customers whose personal information or stored data was accessed, but has not published a count of affected accounts or a full list of exposed data types — its 11 November update said it was still determining "what user data may have been affected." Apify also says it found no evidence that its OAuth connections were the attack vector.

Apify's stated response: closed the access path, revoked some external OAuth connections including GitHub as a precaution, rotated critical internal secrets, added network restrictions and stronger internal authentication, notified authorities, and began a full stack review. It promised a further update within 72 hours and a post-mortem within a week.

What's reported but not official

SecurityWeek cites a breach-notification screenshot an Apify customer posted to Reddit — not an official Apify disclosure — listing names, emails, billing details, account activity, IP addresses, salted password hashes, 2FA recovery codes, phone numbers, and authentication tokens tied to Google and GitHub sign-ins. The same notification says card data was limited to cardholder name, expiry, and last four digits, with no full numbers or security codes. Treat that list as unverified until Apify's post-mortem either confirms or narrows it. Apify reports about 91,000 customers; it has not said how many were in scope.

Action checklist

1. Rotate your Apify API tokens and Apify Proxy passwords. Apify rotated these server-side; rotate anything you cached in CI, secrets managers, or Actor configs.
2. Reset 2FA through the Apify Console, and reconnect GitHub for Actors built from private repositories.
3. Lock down storages. Set resource access to Restricted under Settings → General resource access — Apify warns that an open storage is readable by anyone who knows its storage ID.
4. Hunt for token reuse. If an Apify token was valid elsewhere, assume it is burned and revoke it.
5. Expect phishing. Apify says it will never ask for passwords, 2FA codes, or payment details; verify any "Apify" mail against the status page.

Context

This is the same failure mode behind a run of 2026 SaaS incidents — one stolen secret that is trusted deeper than it should be, cascading into tenant data, as in the M365 token spray and replay that hit 79 orgs. An automation platform is a high-value target precisely because its tokens reach into customers' repos, proxies, and pipelines. The defensive takeaway is unchanged: scope tokens narrowly, rotate on a schedule, and never let a platform credential double as a key to everything it touches.