Incident BriefingsApify credential and account compromise

Apify credential and account compromise

Apify confirmed credential misuse and customer-account access during November 9–10, 2026, followed by containment and notifications.

Last modified

Summary

  • Environment: Internal systems and related customer accounts
  • Operational impact: Credentials rotated and some integrations require reconnection
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 13, 2026; updated as evidence emerges.

What happened

Apify said an attacker used a compromised credential to obtain account credentials and access related accounts during November 9–10, 2026. [1]

Impact

By November 12, Apify had notified customers whose personal information or stored data was accessed. It warned that further affected accounts could still be identified; no total was disclosed. [1]

Timeline

  1. Unauthorized access begins

    Apify dates the activity to November 9–10.

    [1]

  2. Access detected and cut off

    Detection occurred at 12:13 UTC.

    [1]

  3. Affected customers notified

    The incident report confirmed personal-information or stored-data access.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 13, 2026.

Threat Group & Attack Vector

The original credential-theft method is unknown. Revoked OAuth connections were precautionary; Apify had not found them to be an attack vector. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Apify rotated internal secrets, added monitoring and notified authorities. It reported no further detected attacker activity since November 11. [1]