Apify Discloses Credential Theft Exposing Some Customer Accounts

Update

Update: We have notified customers whose personal information or stored data was accessed in this incident. Details are in the email they received. If you haven’t received an email from us, we have not identified your account as affected so far. We will contact any additional customers directly if this changes.

Next update within 24 hours.

Update

Update: Our investigation is ongoing.

On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November.

We are notifying affected users individually. Do not hesitate to reach out to us with questions.

We have:

• As a precaution, revoked some OAuth connections to external integrations. Our investigation has not found that these connections could be used as an attack vector.
• As a precaution, rotated various critical internal secrets.
• We continue with dozens of additional activities, about which we will share information in later updates and a post-mortem.
• We notified the relevant authorities.

For you:

• If you got an email from us, follow its instructions.
• If you build Actors from private GitHub repos, reconnect GitHub: open an Actor built from GitHub → "Change provider" → GitHub → authorize (once per account and per organization).
• If prompted, reconnect your integrations.

Next update within 6 hours, and a postmortem follows the remediation.

Investigating

On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems. We detected the activity on 11th November at 12 UTC, cut off access, and started an investigation that is still ongoing.

We are currently investigating the scope of the incident, including what user data may have been affected. If we determine that your account or data was affected, we will contact you directly.

We have prevented further unauthorized access and added additional monitoring to our systems.

As a precaution, we revoked some OAuth connections to external integrations, including GitHub. Affected users of integrations other than GitHub will be prompted to reconnect via a separate email notification.

If our investigation shows that your tokens were affected, we will rotate them on your behalf and notify you. This incident affects: API (api.apify.com), Actors, and General.