Apify Was Hacked

Update: Our inquiry and reply are ongoing.

What we have done since the final update
- API tokens are now stored lone as hashes, which limits the effect of any akin incident.
- Added additional safety layers to obstacle the assault paths, including network restrictions between inner services and stronger authentication on inner systems.
- We are hearing alongside a thorough safety assessment of our complete stack.
- Continuing log inspection and monitoring for any doubtful activity.
- Other activity is in progress, and we volition portion additional in upcoming updates.

What we propose to all users
- Restrict admission to your storages. In Console, go to Settings → General asset admission and set it to Restricted. While it’s open, anyone who knows a retention ID can peruse that storage.
- Be careful of phishing. Apify volition never ask for your password, 2FA codes, or fee details.

Next steps
- We volition article the next update inside 72 hours and publish a post-mortem alongside the base logic and remediation inside a week.
- If you have questions, communication Support or answer to the email you received.

Posted Nov 13, 2026 - 17:36 CET

Update: We have notified customers whose individual data or stored data was accessed in this incident. Details are in the email they received. If you haven’t received an email from us, we have not identified your document as affected so far. We volition communication any additional customers immediately if this changes.

Next update inside 24 hours.

Posted Nov 12, 2026 - 17:16 CET

Update: Our inquiry is ongoing.

On 9 and 10 November, an unauthorized third gathering used a compromised credential to get a figure of document credentials and accessed connected Apify accounts. This admission way is closed, and we have detected no additional action from the attacker since 11 November.

We are notifying affected users individually. Do not hesitate to attain out to us alongside questions.

We have:
- As a precaution, revoked several OAuth connections to external integrations. Our inquiry has not established that these connections could be used as an assault vector.
- As a precaution, rotated assorted crucial inner secrets.
- We continue alongside dozens of additional activities, concerning which we volition portion data in afterward updates and a post-mortem.
- We notified the applicable authorities.

For you:
- If you got an email from us, prosecute its instructions.
- If you build Actors from personal GitHub repos, reconnect GitHub: open an Actor built from GitHub → "Change provider" → GitHub → authorize (once per document and per organization).
- If prompted, reconnect your integrations.

Next update inside 6 hours, and a postmortem follows the remediation.

Posted Nov 12, 2026 - 12:08 CET

On 9 and 10 November 2026, an unauthorized third gathering gained admission to parts of Apify’s inner systems. We detected the action on 11th November at 12:13 UTC, cut off access, and started an inquiry that is motionless ongoing.

We are currently examining the range of the incident, including what person data may have been affected. If we decide that your document or data was affected, we volition communication you directly.

We have prevented additional unauthorized admission and added additional monitoring to our systems.

As a precaution, we revoked several OAuth connections to external integrations, including GitHub. Affected users of integrations another than GitHub volition be prompted to reconnect via a distinct email notification.

If our inquiry shows that your tokens were affected, we volition rotate them on your behalf and notify you.

Posted Nov 11, 2026 - 20:46 CET