Apify Security Incident

Apify disclosed unauthorized access to parts of its internal systems on November 9 and 10, 2026. The intruder used a compromised credential to obtain some account credentials and access related Apify accounts. Apify detected the activity at 12:13 UTC on November 11, cut off the access route, and reported no further attacker activity since that day. The incident affects its API, Actors, and general services. The investigation is still determining the full scope and what user information or stored data was accessed. Apify has begun contacting customers whose personal information or stored data it identified as affected; customers who have not received a notice have not been identified as affected so far.

Apify revoked some OAuth connections, including GitHub, as a precaution, rotated critical internal secrets, added monitoring, and notified relevant authorities. It says its investigation has not found that the revoked integrations could have enabled the attack. Users who received an email should follow its instructions. Those who build Actors from private GitHub repositories need to reconnect GitHub by changing an Actor’s provider and authorizing the connection; some users may also be prompted to reconnect other integrations. Apify will rotate any user tokens found to be affected and notify those customers. Further updates and a post-incident review are planned after remediation.