Actively exploited Security news
Apify breach: attacker used a compromised credential to obtain user account credentials
Web scraping and automation platform Apify detected on 11 November 2026 that an unauthorized third party had used a compromised credential on 9 and 10 November to obtain a number of account credentials and access related Apify accounts. The company closed the access path, revoked some OAuth connections including GitHub, and rotated internal secrets. Here is what is confirmed and what users need to do.
Key points
- According to Apify's status page, an unauthorized third party used a compromised credential on 9 and 10 Nov 2026 to obtain a number of account credentials and accessed related Apify accounts.
- Apify detected the activity on 11 Nov at 12:13 UTC and cut off access. It has seen no further attacker activity since 11 Nov.
- As a precaution it revoked some OAuth connections to external integrations, including GitHub, and rotated critical internal secrets. Affected users are being contacted individually, and Apify will rotate their tokens if needed.
- Update, evening of 12 Nov: Apify confirmed that the attacker accessed personal information or stored data belonging to some customers and has notified them by email. If you have not received an email, your account has not been identified as affected so far.
- Update, 13 Nov: Apify now stores API tokens only as hashes, has restricted network traffic between internal services and strengthened authentication on internal systems. It advises users to set storage access to Restricted and promises a post-mortem on the root cause within a week.
- Apify has notified the relevant authorities. It has not said how many accounts were affected or how the initial credential was compromised.
What happened
Apify, a Prague-based web scraping and automation platform, announced a security incident on its status page on 11 November 2026. According to the 12 November update, an unauthorized third party used a compromised credential on 9 and 10 November to obtain a number of account credentials and accessed related Apify accounts.
Apify detected the activity on 11 November at 12:13 UTC and cut off the attacker's access. The company says the access path is closed and it has seen no further activity since 11 November. The investigation is ongoing; Apify has notified the relevant authorities and promises further updates and a postmortem.
In an update on the evening of 12 November, Apify confirmed that the attacker accessed personal information or stored data belonging to some customers. Those customers have been notified by email. If you have not received one, your account has not been identified as affected so far; Apify says it will contact anyone else directly if the investigation finds more.
What Apify has not said publicly: how many accounts were affected, exactly what the attacker saw (for example scraping results or secrets stored in Actors), or what the initial credential was and how it was compromised.
What Apify has done
- Revoked some OAuth connections to external integrations, including GitHub. Apify says its investigation has not tied these connections to the attack - this is a precaution.
- Rotated critical internal secrets.
- Is notifying affected users individually, and will rotate their tokens on their behalf if they were affected.
- Now stores API tokens only as hashes (13 Nov update), so they can no longer be read back from the database in plain form.
- Added further security layers: network restrictions between internal services and stronger authentication on internal systems. A security review of the whole stack and further log analysis are under way.
What to do
- If Apify emailed you, follow its instructions. Verify them on Apify's status page and don't click links in the email - fake "notifications" often follow incidents. You can check an unfamiliar link with our link checker.
- Building Actors from private GitHub repos? You need to reconnect GitHub, separately for each account and organization (Apify says via "Change provider").
- Reconnect other integrations if prompted.
- Restrict storage access. On 13 Nov Apify advised setting "General resource access" to Restricted under Console → Settings → General, so datasets and key-value stores can no longer be opened just by knowing their ID. Apify also reminds users it will never ask for passwords, 2FA codes or payment details.
- Our extra advice: rotate your Apify API token and third-party keys stored in Actor environment variables, and review GitHub's audit log for what the Apify app did between 9 and 11 November. If you suspect an account takeover, see Hacked account: what to do.
Timeline
Updates
- 13 Nov 2026, evening - In its 17:36 CET update, Apify said it now stores API tokens only as hashes, has restricted network traffic between internal services and strengthened authentication on internal systems. It advises users to set storage access to Restricted and to watch out for phishing. The next update is due within 72 hours, with a post-mortem on root cause and remediation within a week. Apify still has not said how many accounts were affected.
- 13 Nov 2026 - In an update on the evening of 12 November, Apify confirmed that the attacker accessed personal information or stored data for some customers and has notified them by email. Customers without an email have not been identified as affected so far. Apify promised its next update within 24 hours.
- 12 Nov 2026 - first version of this article.
FAQ
Apify hasn't emailed me. Do I need to do anything?
According to its 12 Nov update, Apify has already emailed the customers whose personal information or stored data was accessed. If you have not received an email, your account has not been identified as affected so far, and Apify says it will contact you directly if that changes. But if you build Actors from a private GitHub repository, you have to reconnect GitHub regardless - Apify revoked those connections for everyone. As a precaution we suggest rotating your Apify API token and any third-party keys stored in Apify (Actor environment variables, proxy and cloud keys).
Was my scraped data exposed?
On 12 Nov Apify confirmed that the attacker accessed personal information or stored data for some customers and notified them by email. It has not said publicly which data or how many accounts; the investigation is ongoing, and on 13 Nov the company promised a post-mortem on the root cause and remediation within a week. If you received an email, follow its instructions.
Is the email from Apify genuine?
Publicized incidents are often followed by fake notification emails. Don't click links in the email; sign in to Apify directly and check the instructions on status.apify.com. You can check a suspicious link with our link checker first.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.
Actively exploited
Cairn: CL-STA-1238 let autonomous AI agents attack chipmakers, defense firms and nonprofits
On 12 November 2026 Unit 42 (Palo Alto Networks) published an analysis of a campaign in which a China-nexus actor used a customized fork of the open-source Cairn framework. In August and September 2026 its AI agents ran 25 operations against at least 19 organizations largely on their own, from reconnaissance to persistence. Nothing about it was novel: weak passwords, open registration endpoints and old bugs. Here is what is confirmed, the indicators, and what it means for defenders.
Actively exploited
Operation Endgame takes down Gootloader, CastleRAT and StealC servers, recovers 6.4 million victim records
On 12 November 2026 Europol announced the latest Operation Endgame strike. Police and private-sector partners actioned 235 servers and 257 domains used by the Gootloader, CastleRAT and StealC malware and found more than 6 million stolen credentials in the seized infrastructure. The data is going to services that notify victims. Here is what the three malware families do, how to check whether you are a victim, and what WordPress site owners should do.