Apify said on its status page that an unauthorized third party got into its systems on 9 and 10 November 2026. The attacker used a compromised credential to collect a number of account credentials and reach related accounts. Apify said it spotted the activity on 11 November and closed that access path. It has seen no new attacker activity since 11 November. As a precaution, it cut some OAuth links to outside services, including GitHub, and changed critical internal secrets. It has told the relevant authorities.
Apify's notice does not list which data was taken or how many customers are affected. It said it has emailed customers whose personal or stored data was accessed, and that its investigation continues. A Reddit user said Apify's email to them listed names, email addresses, billing details, hashed passwords, two-factor settings with recovery codes and phone numbers, and Google or GitHub sign-in tokens. The status page does not show that list.
Apify told users who build Actors from private GitHub repos to reconnect GitHub. Anyone with an account should look for its email and follow the steps, since the full scope is still open.