Apify 遭黑客攻击 API 令牌与用户数据泄露

Update

Update: Our investigation and response are ongoing.

What we have done since the last update

• API tokens are now stored only as hashes, which limits the impact of any similar incident.
• Added additional security layers to block the attack paths, including network restrictions between internal services and stronger authentication on internal systems.
• We are proceeding with a comprehensive security review of our entire stack.
• Continuing log analysis and monitoring for any suspicious activity.
• Other work is in progress, and we will share more in upcoming updates.

What we recommend to all users

• Restrict access to your storages. In Console, go to Settings → General resource access and set it to Restricted. While it’s open, anyone who knows a storage ID can read that storage.
• Be cautious of phishing. Apify will never ask for your password, 2FA codes, or payment details.

Next steps

• We will post the next update within 72 hours and publish a post-mortem with the root cause and remediation within a week.
• If you have questions, contact Support or reply to the email you received.

Update

Update: We have notified customers whose personal information or stored data was accessed in this incident. Details are in the email they received. If you haven’t received an email from us, we have not identified your account as affected so far. We will contact any additional customers directly if this changes.

Next update within 24 hours.

Update

Update: Our investigation is ongoing.

On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November.

We are notifying affected users individually. Do not hesitate to reach out to us with questions.

We have:

• As a precaution, revoked some OAuth connections to external integrations. Our investigation has not found that these connections could be used as an attack vector.
• As a precaution, rotated various critical internal secrets.
• We continue with dozens of additional activities, about which we will share information in later updates and a post-mortem.
• We notified the relevant authorities.

For you:

• If you got an email from us, follow its instructions.
• If you build Actors from private GitHub repos, reconnect GitHub: open an Actor built from GitHub → "Change provider" → GitHub → authorize (once per account and per organization).
• If prompted, reconnect your integrations.

Next update within 6 hours, and a postmortem follows the remediation.

Investigating

On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems. We detected the activity on 11th November at 12 UTC, cut off access, and started an investigation that is still ongoing.

We are currently investigating the scope of the incident, including what user data may have been affected. If we determine that your account or data was affected, we will contact you directly.

We have prevented further unauthorized access and added additional monitoring to our systems.

As a precaution, we revoked some OAuth connections to external integrations, including GitHub. Affected users of integrations other than GitHub will be prompted to reconnect via a separate email notification.

If our investigation shows that your tokens were affected, we will rotate them on your behalf and notify you. This incident affects: API (api.apify.com), Actors, and General.