Apify internal systems breached, some customer data accessed
Apify, a Czech web scraping and automation platform, suffered an intrusion into its internal systems on November 9–10 using stolen credentials. The intruder accessed customer accounts and some data, and customer notifications covered personal information, password hashes, two-factor authentication recovery codes, and external login tokens, among other items. The company rotated API tokens and key internal secrets, disconnected some external OAuth connections, and advised customers to reset two-factor authentication.
Key facts
- Affected organization
- Apify
- Incident type
- Data breach
- Occurred / detected
- 2026-11-09
- Scale of damage
- Not confirmed
- Cause / method
- Intrusion into internal systems using stolen credentials
- Location
- Czechia
If your data was exposed
Exposed dataPassword
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
Timeline
- An intrusion into internal systems using stolen credentials began and continued until November 10.
- The rotation of API tokens and key internal secrets, the disconnection of some external OAuth connections, and advice to reset two-factor authentication became public.
- Access to some customer data and the contents of customer notifications, including password hashes and authentication recovery codes, became public.
3 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.