Apify Was Hacked

Apify reported that an unauthorized party accessed parts of its internal systems on November 9 and 10, 2026, using a compromised credential to obtain account credentials and reach related Apify accounts. The company detected the activity on November 11 at 12:13 UTC, closed the access route, and says it has seen no further attacker activity since that day. The incident affects Apify’s API, Actors, and general services. Apify is investigating which accounts and data were accessed and has contacted customers whose personal information or stored data it identified as affected; it says it will notify additional customers if the investigation finds more. Some OAuth connections, including GitHub, were revoked as a precaution, and affected users may need to reconnect integrations.

Apify has rotated critical internal secrets, added monitoring and stronger protections between internal services, and changed API tokens to be stored as hashes to reduce the impact of similar incidents. It is conducting a security review and continuing to analyze logs. Users are advised to restrict storage access in Console settings, since an open storage can be read by anyone who knows its ID, and to beware of phishing: Apify says it will not request passwords, two-factor codes, or payment details. The company plans further incident updates and a post-mortem covering the root cause and remediation; affected users should follow instructions sent directly to them.