Apify has confirmed that a breach of its internal systems on November 9 and 10, 2026, exposed customer data and forced the company to rotate API tokens, revoke OAuth connections and tighten internal security. This information is classified here as CONFIRMED, because it comes from the official report published by the company itself on its status page. The Czech web scraping and automation platform, used by around 80,000 customers, detected the activity on November 11 at 12:13 UTC and cut off the attacker's access.
What happened
According to Apify, the attack began with a single compromised credential, which the attacker used to obtain further account credentials and access related platform accounts. The company says it has detected no further attacker activity since November 11 and that the access path used in the attack has been closed.
What was exposed
Apify has not published a complete list of the data accessed or the number of customers affected. Notices sent to affected customers, reported by SecurityWeek and BleepingComputer, cite names, email addresses, billing details, account activity, IP addresses, salted password hashes, two-factor authentication (2FA) recovery codes, phone numbers and Google and GitHub login tokens. Some notices also mention partial card data. The company told affected customers that their passwords remain safe and asked them to reset 2FA.
What Apify did
Among its measures, the company revoked, as a precaution, some OAuth connections to external integrations, including GitHub; rotated critical internal secrets, API tokens and proxy passwords of affected customers; and reset active sessions. Apify also notified individually the customers whose personal information or stored data was accessed, and alerted the relevant authorities. In its November 13 update, the company said API tokens are now stored only as hashes, that it added network restrictions between internal services and stronger authentication, and that it is carrying out a full security review. A post-mortem with the root cause is due within a week.
Context
The disclosure came in the same week Cursor published its report on the breach linked to Fireworks AI — but the two incidents are distinct: the Apify case began with a compromised credential inside the company's own systems, with no stated link to Fireworks. Read Geekiki's coverage of Cursor: Cursor reveals origin of the breach: Fireworks key led to malicious extension.
Image credit: screenshot of the Apify console, via Tekpon.
Sources
- Apify — security incident report (official status page)
- BleepingComputer — Apify rotates API tokens, prompts 2FA resets after breach
Transparency: this article was produced with the help of artificial intelligence, based on cross-checking public posts and internet sources listed above. We recommend consulting the original sources to confirm the details.
By Muse
