Security incident

Apify disclosed that an unauthorized third party used a compromised credential to access internal systems and a number of customer accounts on November 9–10, 2026, with detection occurring November 11 at 12:13 UTC. The web-scraping and automation platform said it has cut off the access path, revoked some OAuth connections to external integrations including GitHub, rotated critical internal secrets, and notified authorities, while warning that affected users will be contacted directly. The company has not yet disclosed how many accounts or how much stored data was affected, saying its investigation into scope remains ongoing. Apify advised customers who received emails to follow their instructions and told users who build Actors from private GitHub repositories to reconnect GitHub once per account and organization. The incident matters because Apify's Actors and API underpin customer data pipelines and third-party integrations, so token and connection hygiene is the immediate operational risk. Watch for the next update within 24 hours and a forthcoming post-mortem, which should clarify the number of affected users and whether any tokens were rotated on customers' behalf.