---
title: "Apify credential and account compromise"
description: "Apify confirmed credential misuse and customer-account access during November 9–10, 2026, followed by containment and notifications."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/apify-credential-and-account-compromise-2026"
markdown_url: "https://www.ally.security/incidents/apify-credential-and-account-compromise-2026.md"
stix_url: "https://www.ally.security/incidents/apify-credential-and-account-compromise-2026/stix.json"
---

# Apify credential and account compromise

Apify confirmed credential misuse and customer-account access during November 9–10, 2026, followed by containment and notifications.

Last modified Nov 13, 2026 · 1 source

## Summary

- **Environment:** Internal systems and related customer accounts
- **Operational impact:** Credentials rotated and some integrations require reconnection
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Apify](https://apify.com/) said an attacker used a compromised credential to obtain account credentials and access related accounts during November 9–10, 2026. [1](#source-1)

## Impact

By November 12, Apify had notified customers whose personal information or stored data was accessed. It warned that further affected accounts could still be identified; no total was disclosed. [1](#source-1)

## Timeline

### November 9, 2026 — Unauthorized access begins

Apify dates the activity to November 9–10. [1](#source-1)

### November 11, 2026 — Access detected and cut off

Detection occurred at 12:13 UTC. [1](#source-1)

### November 12, 2026 — Affected customers notified

The [incident report](https://status.apify.com/incidents/sxd1dj5j6749) confirmed personal-information or stored-data access. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The original credential-theft method is unknown. Revoked OAuth connections were precautionary; Apify had not found them to be an attack vector. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): compromised credentials enabled account access. [1](#source-1)

## Response

Apify rotated internal secrets, added monitoring and notified authorities. It reported no further detected attacker activity since November 11. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/apify-credential-and-account-compromise-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Apify security incident updates

official · Apify · Nov 11, 2026

<https://status.apify.com/incidents/sxd1dj5j6749>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Discovered At · 100% confidence · current**  
   Apify credential and account compromise: 2026-11-11
2. **Began At · 100% confidence · current**  
   Apify credential and account compromise: 2026-11-09
3. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: By November 12 17:16 CET Apify had notified customers whose personal information or stored data was accessed. Additional affected accounts could still be identified. No total was disclosed.
4. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: Apify rotated critical internal secrets, notified authorities and revoked some external OAuth connections as a precaution. Its investigation had not found those connections could serve as an attack vector.
5. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: Affected customers notified
6. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: Apify detected activity November 11 at 12:13 UTC, cut off access and added monitoring. It reported no further detected attacker activity since November 11.
7. **Occurred At · 100% confidence · current**  
   Affected customers notified: 2026-11-12
8. **Used Attack Technique · 100% confidence · current**  
   Apify credential and account compromise: https://attack.mitre.org/techniques/T1078/
9. **Occurred At · 100% confidence · current**  
   Unauthorized access interval begins: 2026-11-09
10. **Affected Organization · 100% confidence · current**  
   Apify credential and account compromise: Apify
11. **Occurred At · 100% confidence · current**  
   Activity detected and access cut off: 2026-11-11
12. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: Unauthorized access interval begins
13. **Disclosed At · 100% confidence · current**  
   Apify credential and account compromise: 2026-11-11
14. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: Activity detected and access cut off
15. **Resulted In · 100% confidence · current**  
   Apify credential and account compromise: On November 9–10 an unauthorized third party used a compromised credential to obtain account credentials and access related Apify accounts.
16. **Ended At · 100% confidence · current**  
   Apify credential and account compromise: 2026-11-10

</details>