{"id":"CMP-202611-fshrtn","kind":"campaign","aliases":[],"related":[],"title":"Apify breached: attackers got into its internal systems; Apify rotated all customer API tokens and Proxy passwords, ended sessions and revoked GitHub sign-in and some OAuth connections","description":null,"summary":"Apify (web scraping and AI agent data platform) found unauthorized access to its internal systems. It rotated critical internal secrets and revoked some third-party OAuth connections. On the evening of 11 Nov 2026 it told account holders it had rotated all API tokens and Proxy passwords, ended sessions, revoked GitHub sign-in and asked for 2FA resets. Old tokens stopped working at once. How the attackers got in, what they reached, and whether customer data or secrets stored in Actors were taken: unknown. Start date of the access: unknown.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apify","fixed":[],"affected":"all accounts","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"You use Apify (Actors, API, Proxy, CLI, the Apify MCP server, or integrations that hold an Apify token). Look for Actor runs, schedules, webhooks or token use you did not start. Apify's Console shows no token created or last-used dates and has no audit log, so check the logs of any service whose keys are stored in Actor secret environment variables or key-value stores for use you did not expect.","fix":"Create new Apify API tokens (rotated tokens cannot be copied back out of the Console). Update them everywhere: CI, Tasks, schedules, webhooks, integrations. Sign in to the CLI again. Rebuild every Actor after you change its secret environment variables. Reset 2FA when Apify asks. Reconnect GitHub and any OAuth integrations. As a precaution, rotate any third-party keys (cloud, AI API, databases) stored in Actor environment variables or stores, at the service that issued them. Expect phishing that pretends to be Apify's token-reset or 2FA emails: sign in at apify.com directly instead of following links.","status":"open","published_at":null,"first_seen_at":"2026-11-12T14:54:44+00:00","triaged_at":"2026-11-12T14:54:44+00:00","updated_at":"2026-11-12T14:56:11+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-12T15:09:38Z","path":"third-party-breach","entry":"unknown","reason":"The record says Apify found unauthorized access to its internal systems but that how the attackers got in is unknown, while customers were told to rotate their API tokens, Proxy passwords and third-party keys stored in Actors as a precaution because whether customer data or Actor-stored secrets were taken is unknown.","history":[{"at":"2026-11-12T14:59:21Z","path":"third-party-breach","entry":"unknown","confidence":0.75}],"confidence":0.7}},"analyst_status":"done","analyst_note":null,"search":"'-202611':31A '11':70B '2026':72B '2fa':96B 'access':48B,128B 'account':75B 'actor':120B 'agent':43B 'ai':42B 'api':13A,81B 'apifi':1A,9A,38B 'apify':33A 'ask':94B 'attack':3A,106B 'breach':2A 'campaign':34B 'cmp':30A 'connect':29A,65B 'critic':55B 'custom':12A,114B 'data':44B,115B 'date':125B 'earli':36B 'early-warn':35B 'end':18A,86B 'even':68B 'found':46B 'fshrtn':32A 'github':22A,89B 'got':4A,107B 'holder':76B 'intern':7A,51B,56B 'nov':71B 'oauth':28A,64B 'old':98B 'parti':63B 'password':17A,85B 'platform':45B 'proxi':16A,84B 'reach':111B 'reset':97B 'revok':21A,59B,88B 'rotat':10A,54B,79B 'scrape':40B 'secret':57B,117B 'session':19A,87B 'sign':24A,91B 'sign-in':23A,90B 'start':124B 'stop':100B 'store':118B 'system':8A,52B 'taken':122B 'third':62B 'third-parti':61B 'token':14A,82B,99B 'told':74B 'unauthor':47B 'unknown':123B,129B 'warn':37B 'web':39B 'whether':113B 'work':101B","nicknames":["Apify breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["apify","apifybreach"],"ptokens":["apify"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"breach","search_a":"'-202611':31A 'api':13A 'apifi':1A,9A 'apify':33A 'attack':3A 'breach':2A 'cmp':30A 'connect':29A 'custom':12A 'end':18A 'fshrtn':32A 'github':22A 'got':4A 'intern':7A 'oauth':28A 'password':17A 'proxi':16A 'revok':21A 'rotat':10A 'session':19A 'sign':24A 'sign-in':23A 'system':8A 'token':14A","search_b":"'11':70B '2026':72B '2fa':96B 'access':48B,128B 'account':75B 'actor':120B 'agent':43B 'ai':42B 'api':81B 'apifi':38B 'ask':94B 'attack':106B 'campaign':34B 'connect':65B 'critic':55B 'custom':114B 'data':44B,115B 'date':125B 'earli':36B 'early-warn':35B 'end':86B 'even':68B 'found':46B 'github':89B 'got':107B 'holder':76B 'intern':51B,56B 'nov':71B 'oauth':64B 'old':98B 'parti':63B 'password':85B 'platform':45B 'proxi':84B 'reach':111B 'reset':97B 'revok':59B,88B 'rotat':54B,79B 'scrape':40B 'secret':57B,117B 'session':87B 'sign':91B 'sign-in':90B 'start':124B 'stop':100B 'store':118B 'system':52B 'taken':122B 'third':62B 'third-parti':61B 'token':82B,99B 'told':74B 'unauthor':47B 'unknown':123B,129B 'warn':37B 'web':39B 'whether':113B 'work':101B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-12T15:06:17+00:00","first_public_at":"2026-11-12T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-fshrtn","url":"https://dev.to/yappman/apify-rotated-every-token-overnight-what-broke-on-our-actors-and-what-we-changed-4pfn","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T14:54:44+00:00","fetched_at":"2026-11-12T14:54:44+00:00","note":null,"cites":["https://dev.to/yappman/apify-rotated-every-token-overnight-what-broke-on-our-actors-and-what-we-changed-4pfn"]}],"documents":[{"id":135701,"url":"https://x.com/BleepinComputer/status/2120888612283662464","title":"@BleepinComputer: Apify rotates API tokens, prompts 2FA resets after breach\nhttps://t.co/ismPovZms","kind":"post","source":"x","publisher":null,"text":"Apify rotates API tokens, prompts 2FA resets after breach\nhttps://t.co/ismPovZmsI\n\nhttps://t.co/ismPovZmsI\n\nlikes 5 reposts 1","published_at":"2026-11-12T14:37:04+00:00","relation":"describes","confidence":null,"note":null},{"id":135553,"url":"https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/","title":"BleepingComputer: Apify rotates API tokens, prompts 2FA resets after breach","kind":"blog","source":"blog","publisher":null,"text":"Apify rotates API tokens, prompts 2FA resets after breach\n\nApify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems. [...]","published_at":"2026-11-12T14:36:47+00:00","relation":"describes","confidence":null,"note":null},{"id":135717,"url":"https://dev.to/yappman/apify-rotated-every-token-overnight-what-broke-on-our-actors-and-what-we-changed-4pfn","title":"Apify rotated every token overnight","kind":"post","source":"analyst","publisher":null,"text":"On the evening of 11 November 2026 Apify told account holders it had rotated all API tokens and Proxy passwords, ended sessions and revoked GitHub sign-in. Old tokens stopped working at once. Secret env vars need an Actor rebuild. Console shows no token created/last-used dates and no audit log.","published_at":"2026-11-12T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[{"company":"Apify","domain":"apify.com","url":"https://stspg.io/7sp049kjvxqb","kind":"statuspage","published_at":"2026-11-11T19:46:21+00:00","quote":"On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems.","confidence":0.9700000286102295,"source":"statuspage","created_at":"2026-11-12T15:05:57+00:00","entry":"stolen-credential"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}