APIFY · INC-apify-sxd1dj5j6749 · Vendor
NO FIX YET · SEE WHAT TO DO
Apify reports that an unauthorized third party used a compromised credential on 9 and 10 November to obtain account credentials and access related Apify accounts. The access path is closed, and the company has seen no further attacker activity since 11 November.
first public Nov 11, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Apify users whose accounts were accessed during the 9 and 10 November incident. Apify is notifying affected users individually, so an email from Apify is the signal that your account was among them. Users who build Actors from private GitHub repos must reconnect GitHub.
Not affected if no-apify-account
Who cares apify, saas, security
Update: Our investigation is ongoing.
On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November.
We are notifying affected users individually. Do not hesitate to reach out to us with questions.
We have:
For you:
Next update within 6 hours, and a postmortem follows the remediation.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.