Apify breach prompts API token rotation and 2FA resets after unauthorized internal system access
On November 9-10, 2026, Apify, a Czech web scraping and automation platform, detected unauthorized access to parts of its internal systems on November 11. The company immediately revoked third-party OAuth connections, rotated critical internal API tokens, reset all active sessions, and prompted customers to reset two-factor authentication (2FA) codes as a precaution. Apify stated that no customer account data stored on the platform appears to have been compromised. Some OAuth integrations, including GitHub, were disabled temporarily pending safe reconnection notice. This incident affects a broad user base including Microsoft and Samsung, highlighting risks in cloud-based automation services.
Detalhes técnicos
The attacker accessed internal systems during a two-day window before detection. Apify's response included revoking OAuth connections and rotating API tokens and Apify Proxy passwords. The reset of active sessions ensures immediate invalidation of existing authenticated sessions. Customers were advised to reset 2FA codes through Apify Console due to possible exposure, though password data remains uncompromised.
Remediação
Apify users are recommended to check communications for details on OAuth reconnections, reset their 2FA codes, and monitor their accounts closely. Organizations should review integrations with Apify and consider additional monitoring or temporary suspension until the incident risk is mitigated.
Linha do tempo
-
Apify breach prompts API token rotation and 2FA resets after unauthorized internal system access
ler a análise desta fonte ocultar
On November 9-10, 2026, Apify, a Czech web scraping and automation platform, detected unauthorized access to parts of its internal systems on November 11. The company immediately revoked third-party OAuth connections, rotated critical internal API tokens, reset all active sessions, and prompted customers to reset two-factor authentication (2FA) codes as a precaution. Apify stated that no customer account data stored on the platform appears to have been compromised. Some OAuth integrations, including GitHub, were disabled temporarily pending safe reconnection notice. This incident affects a broad user base including Microsoft and Samsung, highlighting risks in cloud-based automation services.
Technical Details
The attacker accessed internal systems during a two-day window before detection. Apify's response included revoking OAuth connections and rotating API tokens and Apify Proxy passwords. The reset of active sessions ensures immediate invalidation of existing authenticated sessions. Customers were advised to reset 2FA codes through Apify Console due to possible exposure, though password data remains uncompromised.
Remediation
Apify users are recommended to check communications for details on OAuth reconnections, reset their 2FA codes, and monitor their accounts closely. Organizations should review integrations with Apify and consider additional monitoring or temporary suspension until the incident risk is mitigated.