VULNpocalypse
MediumBreach / campaignMonitoring

Apify discloses breach, rotates API tokens and urges 2FA resets

BleepingComputer reports Apify says an unauthorized party accessed internal systems; affected users are told to reset 2FA in Apify Console.

Published
Exploitation
Not confirmed as a vulnerability exploit. Apify says an unauthorized third party accessed internal systems on 9 and 10 November 2026, as reported by BleepingComputer; the entry point is not confirmed.

What happened

According to BleepingComputer, Apify says that on 9 and 10 November 2026 an unauthorized third party gained access to parts of its internal systems. BleepingComputer reports that the incident was detected the next day at 12:13 UTC, and that Apify says it cut off the attacker’s access and started an investigation into the impact. This is the company’s account as relayed by one outlet; no independent verification is cited.

Per BleepingComputer, Apify’s response included invalidating internal credentials, rotating API tokens and resetting all active sessions. Apify also says it revoked OAuth connections to external integrations, including GitHub, out of an abundance of caution. Affected users are to be told by email when it is safe to reconnect.

BleepingComputer describes Apify as a Czech web scraping and browser automation platform for developers, and says the company reports 80,000 customers.

The customer notifications reported by BleepingComputer differ in tone:

  • One notification says Apify found no indication that account data stored on its platform was affected. A sample seen by BleepingComputer says impacted customers’ Apify API tokens and Apify Proxy passwords were rotated.
  • Another letter to affected customers advises them to reset 2FA through the Apify Console. It warns that their 2FA codes may have been exposed, while saying their passwords remain safe.

Not confirmed in the source: how the attacker got in, who is responsible, how many customers are affected, and what data was accessed. The source gives no CVE and does not say a software vulnerability was involved.

Am I affected?

Apify says it contacted impacted customers directly. If you received an Apify email about this incident, treat yourself as affected. If you did not, the source does not say how to tell whether your account is in scope; check with Apify. Users who connected external integrations such as GitHub may find those connections revoked, per Apify.

What to do now

  1. If you received a notice from Apify, reset your 2FA through the Apify Console, as the company’s letter advises.
  2. Wait for Apify’s email before reconnecting revoked OAuth integrations such as GitHub, as BleepingComputer reports the company will notify users when it is safe.
  3. Note that Apify says it rotated API tokens and Apify Proxy passwords for impacted customers. Check any scripts or services that use those credentials; whether they need new values is not stated in the source.
  4. Watch Apify’s own incident update for further details. BleepingComputer cites it, but the URL was not provided in the sources, so it is not linked here.

Sources