Apify says a compromised credential let an attacker into customer accounts

A scraper platform holds whatever its customers scraped. That data often belongs to third parties. Apify says an attacker reached a slice of it through a stolen credential. The company's status page is the main public record.

Apify posted the incident on 11 November 2026 and has updated it through 13 November. The company says the unauthorised access happened on 9 and 10 November. Detection came on 11 November at 12:13 UTC. No further activity from the attacker has been seen since. A full root-cause write-up is promised within a week.

What Apify says happened

Apify's own words: "An unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts."

The services in scope were the Apify Console, the API at api.apify.com, Actors and the storage behind them. The company did not name how many accounts were affected. It did not name the entry credential. It did not say which Actors were touched.

Apify has contacted customers whose accounts the company believes were accessed. The rest of the status page addresses everyone else.

What Apify is telling customers to do

Three things, in order. First, set storage access to Restricted mode under Console settings. The default lets anyone with a dataset or key-value store ID read it. The incident shows that is enough to see customer data if a key is leaked. Second, reconnect GitHub and other third-party integrations if the Console prompts for it. Apify revoked tokens as part of the response. Third, watch for phishing. Any attacker with scraped context can write a convincing message. Apify has asked customers to be sceptical of unexpected support requests.

What is still unknown

The post is thin on the details a defender wants. Apify has not said what kind of credential was compromised. It has not said how many customer accounts were reached. It has not said what data left the platform. It has not said whether any Actor code was modified. The company says it has not seen the attacker since 11 November. It gives no detection story that would catch a return under a different key.

What this means

For a team running Actors on Apify, the actions are the three above and today. The storage switch is the most important one. It closes the same door the attacker used in the examples on the status page. For a team deciding whether to build on Apify at all, watch the root-cause post Apify promised. The content of that post is the signal. What was logged and what was not matters more than a recovery message.

Source

Apify Security Incident, Apify Status.