Apify Was Breached November 9 and 10. Set Your Storage Access to Restricted Today, Reconnect GitHub, and Rotate Whatever Your Actors Hold.
If your team uses Apify, do three things today. First, in the Apify Console go to Settings, General, resource access, and set it to Restricted. While it is open, anyone who knows a storage ID can read that storage, and Apify says itself that an attacker got into accounts. Second, if you build Actors from private GitHub repositories, reconnect GitHub, because Apify revoked those connections. Third, rotate every secret your Actors carry: API keys in input, environment variables, cookies and session tokens for the sites you scrape. Apify has rotated its own secrets. It cannot rotate the ones you gave it.
What Apify says happened
Apify's own notice is a security incident on its status page, status.apify.com. Its timeline, in its own words:
November 11, 20:46 CET: "On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify's internal systems. We detected the activity on 11th November at 12:13 UTC, cut off access, and started an investigation that is still ongoing."
November 12, 12:08 CET: the attacker "used a compromised credential to obtain a number of account credentials and accessed related Apify accounts." Apify says the access path is closed, it has seen no activity since November 11, and it has notified the authorities.
November 12, 17:16 CET: "We have notified customers whose personal information or stored data was accessed in this incident." If you did not get an email, Apify has not identified your account as affected "so far."
November 13, 17:36 CET: API tokens "are now stored only as hashes." Apify also added network restrictions between its internal services and stronger authentication on internal systems. It promises a post-mortem within a week.
That third update matters most. An earlier Apify notification, quoted by BleepingComputer, said there was no sign that account data stored on the platform was affected. The later status update says personal information or stored data was accessed for some customers. Go by the later one.
The November 13 update also tells you something about the earlier state. If API tokens are "now" stored only as hashes, they were not before.
What is not known
Who. Apify names nobody. Neither does BleepingComputer.
How many accounts. Apify says "a number of account credentials." No count.
What the attacker read. Apify does not say which stored data, datasets or key-value stores were opened.
Indicators. None were published, so we have added nothing to the feed.
Some of the press details. BleepingComputer reported, from customer letters it saw, that customer API tokens and Apify Proxy passwords were rotated and that some users were told to reset 2FA because their codes "may have been exposed." The status page says none of that. Treat it as reported, not confirmed.
Why your own secrets are the real exposure
A scraping platform holds more than its own logins. Actors run with whatever you hand them: API keys for the services they post results to, cookies or session tokens for sites that need a login, proxy credentials, webhook URLs. Datasets can hold the scraped data itself, and sometimes that is personal data.
An attacker with access to an Apify account could read all of it. Apify can reset its own systems. It cannot reset a session cookie for your CRM or a key for your data warehouse. That job is yours.
What to do
Restrict storage access now. Console, Settings, General, resource access, Restricted. This is Apify's own advice.
Read your email from Apify. If you got one, follow it. Apify says it will never ask for your password, 2FA codes or payment details, so treat any "Apify" message that does as phishing. Breach notices attract copycats.
Reconnect GitHub if you build Actors from private repositories: open an Actor built from GitHub, choose Change provider, then GitHub, and authorize. Apify says to do this once per account and once per organization.
Reconnect other integrations when prompted. Apify says it revoked "some OAuth connections to external integrations, including GitHub" as a precaution and found no sign they were used to attack.
Rotate your Apify API tokens anyway, then update every script, scheduler and CI job that uses them. Don't wait for Apify to tell you yours were affected.
Rotate what your Actors carry. List every Actor's input and environment variables, and rotate any key, cookie, session token or password in them, starting with the ones that can write or spend money.
Check the receiving end. In the services those keys reach, look for access between November 9 and now from IP addresses that are not Apify's or yours.
Check GitHub too. In the audit logs of the organizations that were connected, look at what the Apify OAuth app did from November 9 to 11.
How we know
We read Apify's status page directly (HTTP 200), including all four updates through November 13. Apify's blog has no incident post. We read BleepingComputer's November 12 report by Bill Toulas, and we have marked above where it goes beyond what Apify itself published. Neither source published indicators of compromise, so this post adds none to our feed.
Sources
Apify status page, "Security incident": https://status.apify.com/
BleepingComputer, "Apify rotates API tokens, prompts 2FA resets after breach," November 12, 2026: https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments