Apify, the Czech web-scraping and automation platform used by tens of thousands of developers and businesses, has confirmed that an attacker accessed customer data after breaking into parts of its internal systems earlier this month. The company says the intrusion began with a single compromised credential and spread from there.
The unauthorized access took place on November 9 and 10, 2026, and Apify detected it on November 11 at 12:13 UTC, cutting off the attacker's access and launching an investigation. In a series of updates on its status page, the company said the attacker used the first compromised credential to obtain further account credentials and reach related Apify accounts.
Apify, which reports around 80,000 customers including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission and Roche, said it notified customers whose personal information or stored data was accessed, and that it also notified the relevant authorities. It has not said how many customers were affected, and no threat actor has claimed responsibility for the attack.
What was exposed
Apify itself has not published a detailed list of the data involved, but a customer notification shared publicly and reported by SecurityWeek on November 13 lists names, email addresses, billing details, account activity, IP addresses, salted password hashes, two-factor authentication recovery codes, phone numbers and authentication tokens tied to Google and GitHub sign-ins. Card data was limited to the cardholder name, expiry date and last four digits, according to that notice.
Affected customers have been told to reset their two-factor authentication through the Apify Console, with the company warning that their 2FA codes may have been exposed. In one notice seen by BleepingComputer, Apify assured customers that their passwords remain safe, while confirming that customer API tokens and Apify Proxy passwords have been rotated.
How Apify responded
The company has rotated critical internal secrets, invalidated internal credentials, reset all active sessions and revoked some OAuth connections to external services, including GitHub, out of caution. Impacted users will be told by email when it is safe to reconnect those integrations. Apify said its investigation has not found that the OAuth connections were used as an attack vector.
In its November 13 update, Apify said API tokens are now stored only as hashes, that network restrictions and authentication between its internal services have been tightened, and that it is reviewing its entire stack. A full post-mortem has been promised within about a week.
A week of incident reports
Apify's disclosure landed on the same day as two other incident reports from the AI world: Cursor published its account of how a leaked Fireworks AI key led to a backdoored Claude Code extension, and research group Epoch AI published its own incident report. The cluster underlines how much of the modern AI supply chain now runs through a small set of shared vendors and platforms — and how a breach at one of them can reach far beyond its own customer list.
For Apify customers, the immediate advice is straightforward: reset two-factor authentication, rotate any API tokens or proxy credentials that have not already been rotated, and watch for phishing attempts using the exposed contact details. Apify says customers who received no notification have not been identified as affected so far, but the investigation is still running.
