Apify Rotates API Tokens, Advises 2FA Resets After Internal Breach

What happened between November 9 and 11?

Apify detected unauthorized third-party access to parts of its internal systems on November 11, 2026, at 12:13 UTC, following access on November 9 and 10.

The company said it cut off the attacker's access and launched an investigation to determine the impact. Its response included invalidating critical internal secrets and credentials, rotating API tokens and resetting all active sessions.

“On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,” Apify said in its incident update.

In one notification, Apify said it had found no indication that account data stored on the platform had been affected. That wording addresses stored platform data but does not amount to a final conclusion covering every consequence of the intrusion.

Takeaway: The initial response targeted unauthorized access, while Apify reported no sign of impact to stored customer data.

Which credentials and connections did Apify change?

Apify also revoked OAuth connections to external integrations, including GitHub, “out of an abundance of caution.” Affected users will receive an email when it is safe to reconnect those integrations.

A customer notification seen by BleepingComputer said Apify had rotated API tokens and Apify Proxy passwords for impacted accounts. These changes replace earlier credentials used to access the relevant services.

OAuth revocation disconnects an external integration until the customer authorizes it again. Session resets terminate existing authenticated sessions, while token and password rotation stops older credentials from serving as the continuing access path.

Takeaway: Customers may need several administrative steps, but each step limits continued use of access credentials linked to the incident.

What do affected customers need to do?

Another letter advised affected customers to reset two-factor authentication through the Apify Console. Apify warned that their 2FA codes may have been exposed while assuring them that their passwords remain safe.

The customer actions and changes include:

• Reset 2FA through the Apify Console because Apify said the codes may have been exposed.
• Use the rotated API tokens rather than any earlier values stored in connected systems.
• Update Apify Proxy passwords wherever customers use the rotated credentials.
• Reconnect revoked OAuth integrations, including GitHub, only after Apify confirms through email that it is safe.

Apify's warning applies to 2FA codes, not ordinary account passwords. The company expressly said passwords remain safe, even though affected users still face required authentication resets and renewed integration authorization.

Takeaway: Apify said passwords remain safe, but affected users must reset 2FA and expect renewed access credentials.

How large is Apify's customer base?

Apify is a Czech web scraping and browser automation platform for developers. Businesses use its services to collect data from websites, search results and social media posts. The platform grew significantly during the generative AI boom.

Apify reports 80,000 customers, including:

• Microsoft
• Samsung
• T-Mobile
• Accenture
• Siemens
• European Commission
• Roche

The 80,000 figure describes the total reported customer base, not a confirmed count of affected accounts. Apify has not said how many customers received security notices or credential rotations.

For an affected enterprise, each rotated token or revoked integration can require work across every environment that uses it. The scale of that remediation remains unknown because the company has not quantified the affected population.

Takeaway: Apify's customer footprint makes the incident material, although the affected-account count remains undisclosed.

What remains unresolved?

Apify said its investigation would determine the full impact. The update did not specify how the intruder gained access, whether an attacker had been identified, how many customers were affected or what the incident and recovery cost.

Its statement that it found “no indication” of impact to stored account data remains narrower than a completed zero-loss finding. The company has also not issued a final account of the intrusion's scope.

Takeaway: Apify has cut off unauthorized access and reset key access paths, but the final scope and cost remain undisclosed.