Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems.
The incident occurred between November 9 and 10 and was detected the next day at 12:13 UTC. The company reacted by cutting off the attacker's access and launching an investigation to determine the impact.
Apify's response involved invalidating internal credentials, rotating API tokens, and resetting all active sessions.
Apify is a Czech web scraping and browser automation platform for developers. Businesses use its services to collect data for websites, search results, and social media posts.
The platform grew significantly with the generative AI boom, and reports having 80,000 customers, including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission, and Roche.
Rotating customer API tokens and passwords
“On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,” Apify said in an update on the incident.
Apify said it also revoked OAuth connections to external integrations, including GitHub, out of an abundance of caution. Impacted users can expect to be informed via email when it’s safe to reconnect.
In one notification, Apify said it had found no indication that account data stored on its platform had been affected by the incident. A sample seen by BleepingComputer informs that impacted customers' Apify API tokens and Apify Proxy passwords have been rotated.
In another letter sent to affected customers, the company advises recipients to reset their two-factor authentication (2FA) through the Apify Console, warning that their 2FA codes may have been exposed while assuring them that their passwords remain safe.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.