Apify confirmed on November 12 that an attacker accessed some customers’ personal information or stored data during a two-day intrusion into its systems. A breach notice one customer posted on Reddit lists 2FA recovery codes and Google and GitHub sign-in tokens among the exposed records.
At a Glance
- Apify detected the intrusion at 12:13 UTC on November 11, after the attacker accessed internal systems on November 9 and 10.
- The attacker used a compromised credential to obtain more credentials and break into related Apify accounts.
- Apify, which says it has 91,000 customers, hasn’t disclosed how many customer accounts were compromised.
- Full card numbers and security codes weren’t exposed, according to the notice shared on Reddit.
One compromised credential opened the way in
Apify, the Czech web scraping and browser automation platform, set out the timeline on its incident status page. “On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,” the company said.
From there, the attacker turned one compromised credential into a wider foothold, using it to pull additional credentials and reach related accounts. Apify’s cleanup has been broad. It invalidated internal credentials, rotated API tokens, reset every active session, changed critical internal secrets and added monitoring.
Businesses use Apify to collect data from websites, search results and social media posts. Its website names Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission and Roche among its customers. That roster raises the stakes for a platform holding scraping jobs, stored data and links to outside services.
🚨Apify was breached on 9th of November` And apparently the perpetrators got quite a lot of data https://t.co/ahy79nj3ev
— Marcin Dudek | WordPress speed + AI (@MythThrazz) November 12, 2026
Breach notices differ on what customers lost
Apify hasn’t published a full inventory of the exposed data. The most detailed list so far comes from the notice one customer shared on the r/apify subreddit, which says the attacker accessed:
- Names, email addresses and IP addresses.
- Billing details and account activity.
- Salted password hashes, alongside 2FA recovery codes and phone numbers.
- Authentication tokens tied to Google and GitHub sign-ins.
Card data in that notice stopped at cardholder names, expiration dates and the last four digits. That limits direct card fraud, though names, billing details and email addresses still hand phishers plenty to work with.
Other letters read differently. One notification said Apify had found no sign that account data stored on its platform was affected. A sample notice seen by BleepingComputer says impacted customers’ Apify API tokens and Apify Proxy passwords have been rotated. Another letter urges recipients to reset their 2FA through the Apify Console.
The mismatch likely reflects different levels of exposure across accounts, though Apify hasn’t explained how it grouped customers. The recovery codes are the sharpest item on the Reddit list. Those codes exist to get users past a second factor, so a cracked password plus a valid code could defeat 2FA.
Apify cuts GitHub links as the probe continues
Apify revoked some OAuth connections to third-party services, GitHub included, out of an abundance of caution. Its investigation hasn’t found that those connections could have served as an attack vector. For now, the compromised credential remains the only confirmed way in, which makes the GitHub cutoff a precaution. The company said it would email impacted users once reconnecting is safe. Customers who build Apify Actors from private GitHub repositories have been told to reconnect their GitHub integrations.
Recipients of a notice have a short list of steps that helps reduce risk from breached account data. Resetting 2FA in the Apify Console comes first, as the company advised. Scripts and pipelines that still call the old API tokens or proxy passwords will need the new ones. Reviewing which apps hold Google or GitHub access, and changing any password reused elsewhere, also limits exposure.
What’s Next?
Several gaps remain in Apify’s account. How many customer accounts did the attacker reach? Whose credential was compromised first, and how? Have any of the stolen Google or GitHub tokens been used since? And when will the company publish a full list of exposed data?
Customers who haven’t received a notification haven’t been identified as affected so far, Apify says. With the investigation still running, those last two words carry the most weight.
