Apify confirms unauthorized account access and exposure of some customer data
An attacker used a compromised credential to obtain some account credentials and access associated Apify accounts on November 9–10. Apify says it notified customers whose personal information or stored data was accessed. The investigation is ongoing.
- Disclosed
- Nov 11, 2026
- Updated Nov 12, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Apify customers whose accounts or data were accessed, and workflows that used revoked OAuth connections
- Apify · SaaS · data breach · credentials
- In the wild
- Yes
- Apify confirmed unauthorized access to internal systems and customer accounts.
What happened
Apify says an unauthorized third party reached parts of its internal systems and used a compromised credential to obtain some account credentials and access the associated accounts. By November 12, Apify had notified customers whose personal information or stored data was accessed. The notices give account-specific details. The public incident report leaves the affected customer count and complete data scope open.
Apify cut off the access path, added monitoring, rotated critical internal secrets and revoked some third-party OAuth connections as a precaution. The company says it has found no evidence that those connections provided the attack path. Actors built from private GitHub repositories may need reauthorization. Apify said it would rotate affected user tokens and notify users when it identifies them. The company plans to publish a postmortem after remediation.
Crime-scene timeline
Nov 9–10, 2026
An unauthorized party accesses Apify systems
Apify later said the attacker used a compromised credential to obtain some account credentials and access the associated accounts.
Nov 11, 12:13 UTC
Apify detects the activity
The company says it cut off the access path and started investigating.
Nov 11, 19:46 UTC
Apify publishes its first notice
Apify reports internal access and precautionary revocation of some third-party OAuth connections, including GitHub.
Nov 12, 11:08 UTC
Apify describes the credential misuse
It says it saw no further attacker activity since November 11 and had rotated critical internal secrets and notified the relevant authorities.
Nov 12, 16:16 UTC
Apify confirms customer notifications
Apify says it has contacted customers whose personal information or stored data was accessed and will contact others if identified.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Apify security incident updatesPrimaryOfficial timeline, credential misuse, OAuth revocations and confirmation of customer notifications.