Apify says it serves 80,000 customers, including Microsoft, Samsung, T‑Mobile, Accenture, Siemens, the European Commission, and Roche.
Timeline: intrusion between November 9–10, detected the next day at 12:13 UTC
Apify reported that "On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems," and that the activity was detected the next day at 12:13 UTC. The company says it cut off the attacker's access immediately and opened an investigation to determine the impact.
Technical response: invalidated credentials, rotated API tokens, reset sessions, revoked OAuth
According to Apify, the company invalidated internal credentials, rotated API tokens, and reset all active sessions as part of its containment steps. Apify also revoked OAuth connections to external integrations, including GitHub, "out of an abundance of caution." The company said impacted users will be informed by email when it is safe to reconnect those integrations.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCustomer notifications and 2FA guidance
Apify informed customers directly about changes to credentials. A sample notification seen by BleepingComputer said impacted customers' Apify API tokens and Apify Proxy passwords have been rotated. In separate communications to affected customers, Apify advised recipients to reset their two‑factor authentication (2FA) through the Apify Console, warning that their 2FA codes may have been exposed while also assuring them that their passwords remain safe.
Who uses Apify and what is at stake
Apify describes itself as a Czech web scraping and browser automation platform for developers. The company says businesses use its services to collect data from websites, search results, and social media posts. Apify reports a customer base that it values at 80,000 organizations, naming Microsoft, Samsung, T‑Mobile, Accenture, Siemens, the European Commission, and Roche among them—entities that rely on automated data collection for research, product development, monitoring, or compliance workflows.
How technologists, affected enterprises, and end users will respond
- Technologists and security teams: Expect to validate that rotated API tokens and proxy passwords have been replaced in code, CI/CD pipelines, and secrets managers, and to reauthorize only after Apify confirms it is safe to reconnect OAuth integrations such as GitHub.
- Affected enterprises and procurement leaders: These organizations will monitor Apify's investigation outcomes and the emailed notifications about safe reconnection, and they may require evidence of remediation before restoring automated workflows that depend on Apify credentials.
- End users and customers: Individuals and teams told they were impacted have been instructed to reset 2FA through the Apify Console and to watch for Apify emails about when to reestablish external integrations.
Apify has stated it found "no indication that account data stored on its platform had been affected by the incident" in one notification, while simultaneously rotating credentials and urging 2FA resets. The company has revoked third‑party OAuth links and rotated internal and customer‑facing secrets as immediate containment steps; the investigation it launched will determine the full scope and impact. For customers and integrators, the near‑term tasks are clear: follow Apify's emailed instructions, rotate any copied credentials on their side, and delay reconnection of revoked OAuth integrations until Apify authorizes it.
