Apify Was Hacked

Security incident Incident Report for Apify Subscribe to Updates Update Update: Our investigation and response are ongoing. What we have done since the last update - API tokens are now stored only as hashes, which limits the impact of any similar incident. - Added additional security layers to block the attack paths, including network restrictions between internal services and stronger authentication on internal systems. - We are proceeding with a comprehensive security review of our entire stack. - Continuing log analysis and monitoring for any suspicious activity. - Other work is in progress, and we will share more in upcoming updates. What we recommend to all users - Restrict access to your storages. In Console, go to Settings → General resource access and set it to Restricted. While it’s open, anyone who knows a storage ID can read that storage. - Be cautious of phishing. Apify will never ask for your password, 2FA codes, or payment details. Next steps - We will post the next update within 72 hours and publish a post-mortem with the root cause and remediation within a week. - If you have questions, contact Support or reply to the email you received. Posted Nov 13 , 2026 - 17:36 CET Update Update: We have notified customers whose personal information or stored data was accessed in this incident. Details are in the email they received. If you haven’t received an email from us, we have not identified your account as affected so far. We will contact any additional customers directly if this changes. Next update within 24 hours. Posted Nov 12 , 2026 - 17:16 CET Update Update: Our investigation is ongoing. On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November. We are notifying affected users individually. Do not hesitate to reach out to us with questions. We have: - As a precaution, revoked some OAuth connections to external integrations. Our investigation has not found that these connections could be used as an attack vector. - As a precaution, rotated various critical internal secrets. - We continue with dozens of additional activities, about which we will share information in later updates and a post-mortem. - We notified the relevant authorities. For you: - If you got an email from us, follow its instructions. - If you build Actors from private GitHub repos, reconnect GitHub: open an Actor built from GitHub → "Change provider" → GitHub → authorize (once per account and per organization). - If prompted, reconnect your integrations. Next update within 6 hours, and a postmortem follows the remediation. Posted Nov 12 , 2026 - 12:08 CET Investigating On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems. We detected the activity on 11th November at 12:13 UTC, cut off access, and started an investigation that is still ongoing. We are currently investigating the scope of the incident, including what user data may have been affected. If we determine that your account or data was affected, we will contact you directly. We have prevented further unauthorized access and added additional monitoring to our systems. As a precaution, we revoked some OAuth connections to external integrations, including GitHub. Affected users of integrations other than GitHub will be prompted to reconnect via a separate email notification. If our investigation shows that your tokens were affected, we will rotate them on your behalf and notify you. Posted Nov 11 , 2026 - 20:46 CET This incident affects: API (api.apify.com), Actors, and General. ← Current Status Powered by Atlassian Statuspage × Subscribe to Incident Subscribe to updates for Security incident via email. You'll receive email notifications when incidents are updated. VIA EMAIL: Subscribe to Incident By subscribing you agree to our Privacy Policy . This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.