Credential Theft

Web scraping and automation platform Apify disclosed that an unauthorized third party used a compromised credential on November 9-10 to obtain account credentials and access related accounts. The access path is now closed with no attacker activity detected since November 11; Apify has rotated critical internal secrets, revoked some OAuth integration connections, and notified affected users and authorities, with impact spanning its API, Actors, and general services.