Apify, the Prague-based web scraping and browser automation platform, has confirmed that an attacker accessed customer accounts and viewed some customers’ personal information or stored data during a two-day intrusion into its internal systems.
The company said the attacker used a compromised credential to obtain a number of account credentials and then accessed related Apify accounts on November 9 and 10, 2026. Apify has not said how many customers are affected.
Intrusion detected on November 11
According to updates on the Apify status page, an unauthorized third party gained access to parts of the company’s internal systems on November 9 and 10. Apify detected the activity on November 11 at 12:13 UTC, cut off the attacker’s access and started an investigation.
In a November 12 update, Apify said the access path had been closed and that it had detected no further activity from the attacker since November 11. The company said it had notified the relevant authorities but did not name them.
Later that day, Apify said it had emailed every customer whose personal information or stored data was accessed. Customers who did not receive an email have not been identified as affected so far, and Apify said it will contact more people directly if that changes.
What customers were told
Apify has not published a full list of the exposed data on its status page, and the notices sent to customers appear to differ by account.
A copy of one notification that a customer posted publicly lists names, email addresses, billing details, account activity and IP addresses. It also lists salted password hashes, two-factor authentication (2FA) recovery codes and phone numbers, and tokens used for sign-in through Google or GitHub. According to that notice, payment card data was limited to cardholder names, expiration dates and the last four digits of card numbers. Full card numbers and security codes were not exposed.
Other customers were told that their Apify API tokens and Apify Proxy passwords had been rotated, or were asked to reset their 2FA in the Apify Console because their 2FA codes may have been exposed. One of those notices said account passwords remained safe.
BreachNews could not independently confirm which data types apply to which customers.
Tokens rotated and GitHub connections revoked
As a precaution, Apify rotated various critical internal secrets and revoked some OAuth connections to outside integrations, including GitHub. The company said its investigation has not found that those connections could be used as an attack vector.
Customers who build Actors from private GitHub repositories need to reconnect GitHub by opening an Actor built from GitHub, choosing “Change provider,” selecting GitHub and authorizing it once per account and per organization. Users of other integrations will be prompted by email to reconnect.
In its latest update on November 13, Apify said API tokens are now stored only as hashes, which limits the damage from any similar incident. It has also added network restrictions between internal services, stronger authentication on internal systems and a security review of its entire stack.
What Apify users should do now
Apify is urging all users, not only those who were notified, to restrict access to their storages. In the Apify Console, go to Settings, then General resource access, and set it to Restricted. While access is open, anyone who knows a storage ID can read that storage. The company also warned users to watch for phishing and said it will never ask for passwords, 2FA codes or payment details.
Customers who received a notice should also:
- Follow the instructions in the email, including resetting 2FA if asked
- Update scripts, pipelines and integrations that still use old API tokens or Proxy passwords
- Reconnect GitHub and other integrations only after reviewing which repositories and permissions they need
- Change the password on any other account that shared the Apify password
Because the exposed contact and billing details are not public, attackers could use them to write convincing phishing emails that look like real Apify invoices or security alerts. Our guides on rotating leaked API keys after a platform breach and spotting a fake breach notification walk through both risks.
Another developer platform breach
Apify’s platform is used by developers and companies to collect data from websites, search results and social media, often by connecting it to code repositories, cloud storage and AI tools. That makes its API tokens and integrations valuable to attackers.
The incident follows a string of recent breaches at developer and cloud platforms, including Railway, WorkOS and Chainstack.
No threat actor had publicly claimed the Apify breach at time of publication. Apify said it will post its next update within 72 hours and publish a post-mortem with the root cause and remediation within a week.
BreachNews will update this story when Apify releases its post-mortem or discloses the number of affected customers.
