Two Days Inside. Then Every Key Was Burned.
An intruder spent two days inside Apify’s internal systems. The company found out on November 11 — and its answer was to burn the keys: rotate every customer API token and Proxy password, revoke OAuth connections, reset every active session, and tell affected customers to reset their two-factor authentication. It is the right response. It is also the response you only give when you cannot be sure what the intruder touched.
Two days inside
Apify is a Czech web scraping and browser automation platform. Businesses use it to collect data from websites, search results, and social media posts. The platform grew sharply with the generative AI boom and reports 80,000 customers, including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission, and Roche.
That customer list is why a breach of Apify’s internal systems matters beyond Apify itself. An API token is a standing credential: anyone holding one can call the platform as that customer and run their automations. “On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems,” the company said in an update on the incident. The intrusion was detected the next day, November 11, at 12:13 UTC. Apify says it cut off the attacker’s access and launched an investigation to determine the impact.
What got rotated
The rotation is broad, and deliberately so. Apify invalidated internal credentials, rotated API tokens, and reset all active sessions. A notification seen by BleepingComputer confirms that impacted customers’ Apify API tokens and Apify Proxy passwords have been rotated — both the keys that authenticate to the platform and the passwords that authenticate to its proxy service.
It also revoked OAuth connections to external integrations, including GitHub, out of an abundance of caution. Impacted users can expect to be informed via email when it is safe to reconnect. Until Apify says otherwise, integrations that depended on those OAuth connections stay disconnected, and any automation that used a rotated token stops working until it is updated with the new one. That is disruption by design — a dead token cannot be abused, even if it is also a token a legitimate workflow still needs.
The 2FA wrinkle
The most uncomfortable part of the disclosure is the two-factor authentication advice. In a letter to affected customers, Apify advises recipients to reset their 2FA through the Apify Console, warning that their 2FA codes may have been exposed — while assuring them that their passwords remain safe.
Read that carefully, because the distinction matters. Passwords safe, 2FA codes possibly exposed. A second factor that may have been seen by an attacker is a second factor you can no longer trust, and Apify is not pretending otherwise. Resetting 2FA generates a fresh secret, which makes any captured codes useless — and it is the one step only the customer can take.
What we still don’t know
Apify said it found no indication that account data stored on its platform had been affected. That is reassuring, but it is a statement about what the investigation has found so far, not a final verdict — the investigation is still running, and the company has not said how the intruder got in. Two days of access, no disclosed entry point, and a rotation of everything that could plausibly have been seen.
That pattern is familiar from other breaches this month. When Iris Ohyama disclosed its cloud breach, the company could describe what was exposed but not yet who was behind it — and the response was the same shape: suspend, rotate, investigate, disclose what is known. The difference here is the blast radius of the credential. A stolen customer list is a privacy disaster; a stolen API token is a live key to someone else’s infrastructure, which is why the token rotation had to come first and the explanation can come second. It is the same lesson as the secrets that ended up on GitHub: a credential that leaves its home stops being yours the moment it is copied, and the only fix is to make the copy worthless.
What to do now
If you use Apify, do three things today. First, update every place that stored an Apify API token or Proxy password — scripts, environment variables, CI secrets, third-party integrations — with the new credentials. Old tokens are dead; workflows that still hold them will fail, and that failure is the proof the rotation worked.
Second, reset your 2FA through the Apify Console, as the company advises. Do it even if you believe your account was unaffected: the notification went to impacted customers, and the cost of re-enrolling an authenticator is minutes.
Third, check what your tokens were doing. Review recent automation runs and API usage for anything unfamiliar — an unexpected actor, a new schedule, a destination you do not recognize. If anything looks off, treat it as an incident of your own, not as Apify’s problem alone.
Finally, do not reconnect the revoked OAuth integrations until Apify tells you it is safe. The revocation was the precaution; the reconnection is the part that needs the all-clear. Until then, the safest integration is the one that stays disconnected.