Apify breach: stolen credential let attackers into internal systems
Apify Security Incident
On November 9 and 10, 2026, an unauthorized third party used a compromised credential to grab account credentials and reach related Apify accounts. Apify detected the activity on November 11, cut off access, revoked OAuth connections including GitHub, and rotated critical internal secrets. No attacker activity has been seen since November 11. Affected customers are being emailed individually, and a post-mortem will follow.
On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.