{"id":"INC-apify-k950nq1k7lgl","kind":"incident","aliases":[],"related":[],"title":"Apify: Security Incident Notification – March 6, 2026","description":"This incident has been resolved.","summary":"Apify posted a resolved security incident notice dated March 6, 2026 on its status page. The notice gives no details of what was accessed or what an attacker could do.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apify","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apify","incident","security","vendor"],"not_affected_if":[],"how_to_check":"- Read the Apify status notice at https://stspg.io/5k5b239gqvkd for any affected-data or action guidance.","fix":null,"status":"resolved","published_at":"2026-03-11T12:48:42+00:00","first_seen_at":"2026-11-12T15:06:30+00:00","triaged_at":"2026-11-12T15:07:45+00:00","updated_at":"2026-11-12T15:07:45+00:00","category":"vendor","confidence":0.3,"triage":{"at":"2026-11-12T15:07:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Apify: March 6, 2026 security incident resolved, details unknown","impact":"low","summary":"Apify posted a resolved security incident notice dated March 6, 2026 on its status page. The notice gives no details of what was accessed or what an attacker could do.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["apify"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Apify status notice at https://stspg.io/5k5b239gqvkd for what data or accounts were affected and whether users must rotate API tokens.","how_to_check":"- Read the Apify status notice at https://stspg.io/5k5b239gqvkd for any affected-data or action guidance.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":4449,"output_tokens":374,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'2026':7A,27B '6':6A,26B 'access':40B 'apifi':1A,13B,17B 'apify':10A,12A 'attack':44B 'could':45B 'date':24B 'detail':36B 'give':34B 'inc':9A 'inc-apify-k950nq1k7lgl':8A 'incid':3A,14B,22B,47C 'k950nq1k7lgl':11A 'march':5A,25B 'notic':23B,33B 'notif':4A 'page':31B 'post':18B 'resolv':20B,50C 'secur':2A,15B,21B 'status':30B 'vendor':16B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["apify"],"ptokens":["apify"],"labels":["apify","incident","low","security","vendor"],"campaign_type":null,"search_a":"'2026':7A '6':6A 'apifi':1A 'apify':10A,12A 'inc':9A 'inc-apify-k950nq1k7lgl':8A 'incid':3A 'k950nq1k7lgl':11A 'march':5A 'notif':4A 'secur':2A","search_b":"'2026':27B '6':26B 'access':40B 'apifi':13B,17B 'attack':44B 'could':45B 'date':24B 'detail':36B 'give':34B 'incid':14B,22B 'march':25B 'notic':23B,33B 'page':31B 'post':18B 'resolv':20B 'secur':15B,21B 'status':30B 'vendor':16B","search_c":"'incid':47C 'resolv':50C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-03-11T12:48:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"apify:k950nq1k7lgl","url":"https://stspg.io/5k5b239gqvkd","severity":"low","published_at":"2026-03-11T12:48:42+00:00","modified_at":"2026-03-12T09:34:56+00:00","first_seen_at":"2026-11-12T15:06:30+00:00","fetched_at":"2026-11-12T15:56:32+00:00","note":null}],"documents":[],"disclosures":[{"company":"Apify","domain":"apify.com","url":"https://stspg.io/7sp049kjvxqb","kind":"statuspage","published_at":"2026-11-11T19:46:21+00:00","quote":"On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify’s internal systems.","confidence":0.9700000286102295,"source":"statuspage","created_at":"2026-11-12T15:05:57+00:00","entry":"stolen-credential"},{"company":"Apify","domain":"stspg.io","url":"https://stspg.io/7sp049kjvxqb","kind":"statuspage","published_at":"2026-11-11T19:46:21+00:00","quote":"On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.","confidence":0.9700000286102295,"source":"statuspage","created_at":"2026-11-12T15:15:49+00:00","entry":"stolen-credential"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}