Apify, the Czech web scraping and automation platform, has rotated customer API tokens and proxy passwords and reset all active sessions after an unauthorized party accessed parts of its internal systems. The company reports 80,000 customers.
When the Intruder Got In and How Apify Responded
According to Apify, the unauthorized third party accessed internal systems on November 9 and 10. The company detected the intrusion on November 11 at 12:13 UTC and moved to contain it.
Apify cut off the intruder’s access and invalidated internal credentials. It then rotated API tokens and Apify Proxy passwords, reset every active session, and revoked OAuth connections to external integrations, including GitHub. The company sent notification emails to customers, and its investigation is continuing.
Conflicting Notices on 2FA Exposure
Apify’s customer notices do not fully agree on what was exposed. One says no account data appeared to be affected. Another warns that customers’ two-factor authentication codes may have been exposed and advises them to reset 2FA in the Apify Console, while stating that passwords remain safe.
The company has not explained how 2FA codes could be exposed while account data was untouched. Customers who read only the first notice may skip a reset that the second recommends.
Who Uses the Platform and What Is at Stake
Apify lists Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission and Roche among its customers. The platform runs scrapers and automation workloads, so customer accounts typically hold API tokens that grant programmatic access, proxy credentials and integrations with outside services such as GitHub.
Why Rotation of API Tokens and OAuth Grants Matters
Revoking OAuth connections and rotating tokens limits what an intruder could do with stolen credentials. Both are standard containment steps when a platform cannot confirm which secrets were read. They also place work on customers, who must reissue tokens inside their own pipelines and reconnect integrations that Apify cut off.
Apify has not disclosed how many customers were affected or what data the intruder viewed. The company said the scope remains under investigation, and token rotation was applied for affected customers.
What the Incident Shows About Developer-Platform Risk
Automation platforms concentrate secrets. A single account often connects to code repositories, proxies and downstream data sources, and a breach of the platform’s internal systems can threaten each of those links even when customer passwords stay intact.
The incident is also a case study in notification clarity. Two statements from the same company, one reporting no affected account data and one raising possible 2FA code exposure, leave customers to decide which to follow. Detection took about two days from the first intrusion date to the point Apify noticed, and public reporting came on November 12, one day after containment.
Until Apify publishes the result of its investigation, customers with integrations tied to the platform are left to assess their own exposure. The company’s own advice, resetting 2FA in the Console, is the clearest action it has recommended.
Timeline Questions Apify Still Needs to Answer
The two-day gap between the intrusion on November 9 and 10 and detection on November 11 is the central open question for customers. Apify has not said what the intruder could read during that period, which systems counted as “internal,” or whether any customer data beyond tokens and proxy passwords was touched.
Customer Actions Following the Notification
The reset of all active sessions means every user must sign in again. Customers who stored Apify API tokens in scripts, schedulers or CI pipelines will find those jobs failing until they replace the rotated tokens. Customers who connected GitHub or other services through OAuth must also reauthorize, because Apify revoked those grants as a precaution. The company says passwords remain safe, and its advice to reset 2FA addresses the possibility that one-time codes were exposed.
