Apify, the Czech web scraping and browser automation platform, has confirmed that an intruder got into parts of its internal systems on 9 and 10 November 2026 and reached customer accounts. Some customers' personal information or stored data was accessed. Apify spotted the activity on 11 November at 12:13 UTC, blocked the attacker and began an investigation. On 12 November it confirmed that customer data had been exposed. The company has not said how many accounts were affected. Reports of its total customer base differ: SecurityWeek cites the company's own figure of 91,000 customers worldwide, while BleepingComputer reports 80,000. Named customers include Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission and Roche.
What Happened
Apify's status page describes the incident simply: "On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify's internal systems." BleepingComputer reported that the company detected the intrusion at 12:13 UTC on 11 November. Apify then cut off the attacker's access and started investigating.
The company then took these steps:
- Invalidated internal credentials and changed critical internal secrets
- Rotated customers' Apify API tokens and Apify Proxy passwords
- Reset all active sessions
- Revoked some OAuth connections to outside services, including GitHub, as a precaution
- Added extra monitoring
Apify says it has emailed every customer it has identified as affected. Customers who have not received an email have not been identified as affected so far, but the investigation is still going on. A Brazilian outlet, BitNotícias, reports that Apify has seen no new malicious activity since 11 November and has notified the authorities. That second claim also appears in coverage from SMTPedia. Neither the authorities involved nor any regulator filing has been named publicly.
What Was Taken
The accounts of what was exposed do not fully agree. The differences seem to come from Apify sending different notification letters to different groups of customers.
What the fuller notifications list. SecurityWeek reviewed a breach notification that a customer posted on Reddit. It lists:
- Names, email addresses and usernames
- Billing details, account activity, and IP addresses from recent logins
- Salted password hashes
- Two-factor authentication (2FA) recovery codes and 2FA phone numbers
- Authentication tokens linked to Google and GitHub sign-ins
- Partial payment card data: cardholder name, expiry date and last four digits
SMTPedia and the German site Dr. Web describe the same notice. They add billing name and address and tax ID to the list.
What was not exposed, per Apify. Full card numbers and security codes were not exposed. Passwords are stored only as salted hashes, and Apify says they cannot be read. SMTPedia reports that the notice also excludes secret environment variables and secret Actor inputs.
Where the reports conflict. BleepingComputer saw one notification saying Apify had found "no indication" that account data stored on the platform was affected. SMTPedia reports that Apify found no evidence that Actors, runs or datasets were accessed. However, Apify's status page update, reported by SecurityWeek, says some customers had their "personal information or stored data" accessed. A second letter seen by BleepingComputer told recipients to reset their 2FA because their codes may have been exposed, while saying their passwords remain safe. Until Apify publishes a single, complete account, customers should assume that the letter they received describes their own exposure. They should not assume it describes everyone's.
Why It Matters
Apify is part of the data pipelines of many large companies, and its use has grown quickly with generative AI. A breach here touches more than the platform itself, for three reasons:
- 2FA recovery codes plus password hashes. A recovery code lets an attacker skip the second login factor. On its own it is not enough, because the attacker still needs the password. If any of those salted hashes can be cracked, for example because the password was weak or reused, the two together are a complete account takeover kit.
- Sign-in tokens for Google and GitHub. These tokens can carry access beyond Apify itself. Apify says it has found no sign that the revoked OAuth connections were used to attack anything else, but the investigation is still open.
- Convincing phishing. With real names, billing addresses, tax IDs and card digits, an attacker can write very believable fake invoices or fake "reset your 2FA" emails. That is risky because Apify is genuinely asking customers to reset 2FA right now. Apify itself has warned customers about this kind of phishing.
There is also a wider pattern. Dr. Web notes that GitBook and Northflank have reported similar break-ins recently, and that GitBook voided all customer API tokens after an attack on 2 November. Developer platforms that hold tokens and integrations are a repeated target.
The Attack Technique
Apify says the attacker used one compromised credential to get more account credentials, then used those to reach related Apify accounts. This is a classic credential-chaining attack: one stolen login leads to more credentials, which lead to wider access. Apify has not said whose credential it was, how it was stolen, or which internal systems held the other credentials.
Dr. Web points out that Apify reported a separate incident in March. In that case, an employee's GitHub account was used to push malicious changes into several code branches, and Apify said no customer data was affected. Nothing published so far links the two incidents.
What Organizations Should Do
- Check your email and reset 2FA. If Apify wrote to you, set up 2FA again through the Apify Console. Treat old recovery codes as compromised. Change your Apify password too, and change it anywhere else you used the same password.
- Replace rotated tokens in your pipelines. Apify has rotated API tokens and Proxy passwords, so any scheduled jobs, CI pipelines or connected tools that use the old ones will fail. Find them all, issue new credentials, and store them in a secrets manager.
- Review your Google and GitHub authorisations. Check which apps are authorised on accounts used to sign in to Apify. Revoke Apify's access and grant it again only after Apify confirms it is safe. Look through GitHub audit logs for unusual activity around 9 to 11 November.
- Warn finance and accounts payable teams. Expect phishing that quotes real Apify billing details. Check any invoice or payment change through a separate, known contact before acting on it.
- Look at what your scrapers could reach. Review Actor inputs and any data passed to Apify, and replace any downstream credentials that may have been stored there, even though Apify says secret inputs were not exposed.
- Check your own setup for the same weakness. Credential chaining works when one login can unlock a store of other credentials. Make sure service accounts have only the access they need, and that internal credentials are kept in a vault and replaced regularly.
Sources: Apify Confirms Customer Data Accessed in Cyberattack - SecurityWeek | Apify rotates API tokens, prompts 2FA resets after breach | Apify rotates internal credentials following unauthorized ... | Apify Breach Exposes Customer Emails, Billing Data and 2FA Codes | Apify Confirms Breach After Two-Day System Intrusion | Einbruch bei Apify: Unbefugte sahen Konto- und Rechnungsdaten - Dr.... | Plataforma de agentes de inteligência artificial é hackeada e invas... | Apify breach: stolen login exposed customer accounts