Apify confirms attacker accessed customer accounts using a compromised credential

Apify said an attacker used a compromised credential to obtain account credentials and access related customer accounts on Nov. 9-10, 2026, and that it cut off the access on Nov. 11 at 12:13 UTC.

Its status page described the intrusion as “used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.” The company has not identified the compromised credential, and it has not said who the attacker is. Apify has not released a list detailing what was accessed.

The exposed-data list comes from a customer-posted notification; Apify has not published the notice itself, and PrivacyAffairs has not seen one, so treat it as one customer’s copy. The list covers names, IP addresses, billing details, e-mail addresses and account activity.

It also lists salted password hashes and phone numbers, plus recovery codes for multifactor authentication and sign-in tokens for Google or GitHub. It also lists cardholder names and expiration dates along with the last four digits on each card number; full card numbers and security codes were not exposed.

Apify has not given a count of affected customers. The company reported 80,000 customers, including Microsoft, Samsung, T-Mobile, Accenture, Siemens and the European Commission; Roche is also among them. SecurityWeek’s reporting puts Apify’s worldwide customer count at 91,000. The Passwork Blog says the about page lists 91,000 customers as the full base, not the number affected.

On Nov. 12, Apify said some customers saw their personal information or stored data accessed during the attack. A customer notice said Apify saw no indication that the attack affected its platform’s account data. Much of the material stored on a scraping platform comes from what customers gathered at other sites, such as contact lists, social media profiles and reviews. Apify has not identified the stored data it means.

Apify detected the activity on Nov. 11 at 12:13 UTC and ended the attacker’s access. It has detected no further attacker activity since Nov. 11. The company reset all active sessions and rotated API tokens and Apify Proxy passwords for some customers. It also asked customers to reset multifactor authentication after saying 2FA codes may have been exposed, and it told those customers that their account passwords remained safe.

Apify withdrew OAuth connections to outside integrations, including GitHub. As a precaution, it rotated various critical internal secrets, and it implemented additional monitoring. Apify’s investigation has not found evidence that the revoked OAuth connections could serve as an attack vector. Digital Forensics Magazine says accounts demonstrably accessed should be separated from integrations disabled despite a lack of evidence that those connections enabled the intrusion.

For Actors (prebuilt scrapers) built from private GitHub repositories, customers reconnect GitHub via an Actor built from GitHub. They choose Change provider, select GitHub and grant access once for each account and each organization. Apify says affected users should get an e-mail saying when safe to reconnect OAuth connections. When Apify rotates its own tokens, customers’ platform credentials are not rotated.

Apify notified relevant authorities on Nov. 12 without naming them. Apify promised another update within 24 hours, with a post-mortem to come later. The status page still lists the security incident as unresolved, and it shows partial outages affecting API and Actors services without saying whether they relate to the breach. Apify’s latest status page update came Nov. 12 at 17:16 CET; at 17:10 UTC on Nov. 13, a day later, the page had nothing new.

Under Apify’s terms, the customer decides the fate of scraped data and whether anyone in it is told. The addendum makes the customer the controller of personal data and Apify the processor. The addendum requires Apify to tell customers of a breach without undue delay, within 72 hours at the latest. Article 33 of the GDPR gives a controller 72 hours to report a breach to a data protection authority after becoming aware of it unless the breach is unlikely to put people at risk; Article 34 calls for telling the people themselves when the risk is high.

If a notice arrived on Nov. 12, the 72 hours expire around Nov. 15. PrivacyAffairs’ tracker of GDPR fines counts 107 that cite Article 33.

Companies use Apify to gather information on social media posts, websites and search results. Apify runs a marketplace of prebuilt scrapers called Actors; its site lists 118,756 of them. One popular Actor in the store is the Contact Details Scraper, with 68,000 users. It collects email addresses and phone numbers along with social media profiles from websites, and named storages are kept indefinitely, so an account can hold scraping results going back years.

Apify describes datasets as storing results from web scraping, and any logged-in account holder can open those datasets. Apify deletes unnamed datasets when the plan’s retention period ends. Most people appearing in a scraped dataset do not know the dataset includes them.

PrivacyAffairs says recovery codes matter most, since one code gets past a multifactor authentication prompt. It also warns that billing details — a name, an address and the last four digits — can make a fake invoice look real. Per Apify’s documentation, the token sits on the API & Integrations page of the Console. Its shared responsibility documentation calls secret inputs and secure environment variables encrypted.