{"id":"INC-apify-sxd1dj5j6749","kind":"incident","aliases":[],"related":[],"title":"Apify: Security incident","description":"Update: Our investigation is ongoing.\n\nOn 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November. \n\nWe are notifying affected users individually. Do not hesitate to reach out to us with questions.\n\nWe have:\n- As a precaution, revoked some OAuth connections to external integrations. Our investigation has not found that these connections could be used as an attack vector.\n- As a precaution, rotated various critical internal secrets.\n- We continue with dozens of additional activities, about which we will share information in later updates and a post-mortem.\n- We notified the relevant authorities.\n\nFor you:\n- If you got an email from us, follow its instructions.\n- If you build Actors from private GitHub repos, reconnect GitHub: open an Actor built from GitHub → \"Change provider\" → GitHub → authorize (once per account and per organization).\n- If prompted, reconnect your integrations.\n\nNext update within 6 hours, and a postmortem follows the remediation.","summary":"Apify reports that an unauthorized third party used a compromised credential on 9 and 10 November to obtain account credentials and access related Apify accounts. The access path is closed, and the company has seen no further attacker activity since 11 November.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apify","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apify","incident","saas","security","vendor"],"not_affected_if":["no-apify-account"],"how_to_check":"- Check the Apify status page for updates on the investigation: https://stspg.io/7sp049kjvxqb\n- Look for an email from Apify about your account and follow its instructions\n- Review OAuth connections to external integrations in your Apify account","fix":"- Reconnect GitHub for Actors built from private repos: open an Actor built from GitHub, choose \"Change provider\", select GitHub, and authorize (once per account and per organization)\n- Reconnect any integrations if prompted","status":"open","published_at":"2026-11-11T19:46:21+00:00","first_seen_at":"2026-11-12T15:06:29+00:00","triaged_at":"2026-11-12T15:07:46+00:00","updated_at":"2026-11-12T15:07:46+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T15:07:46Z","model":"claude-haiku-5-5","output":{"fix":"- Reconnect GitHub for Actors built from private repos: open an Actor built from GitHub, choose \"Change provider\", select GitHub, and authorize (once per account and per organization)\n- Reconnect any integrations if prompted","reach":"internet","title":"Apify: attacker used a compromised credential to access user accounts","impact":"high","summary":"Apify reports that an unauthorized third party used a compromised credential on 9 and 10 November to obtain account credentials and access related Apify accounts. The access path is closed, and the company has seen no further attacker activity since 11 November.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["apify","saas"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker accessed Apify accounts and obtained account credentials.","analyst_note":"Investigation is ongoing; check the Apify status page and postmortem for affected scope and any further fixes.","how_to_check":"- Check the Apify status page for updates on the investigation: https://stspg.io/7sp049kjvxqb\n- Look for an email from Apify about your account and follow its instructions\n- Review OAuth connections to external integrations in your Apify account","plain_action":"If Apify emailed you, follow the instructions in that email, and reconnect GitHub or your integrations if prompted.","product_name":"","needs_analyst":true,"not_affected_if":["no-apify-account"],"who_is_affected":"Apify users whose accounts were accessed during the 9 and 10 November incident. Apify is notifying affected users individually, so an email from Apify is the signal that your account was among them. Users who build Actors from private GitHub repos must reconnect GitHub.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000791,"input_tokens":4786,"output_tokens":625,"severity_before":"medium","breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'10':28B,64C '11':54B,102C '6':227C '9':26B,62C 'access':35B,40B,82C,87C 'account':32B,38B,79C,85C,215C 'activ':52B,97C,161C 'actor':196C,205C 'addit':160C 'affect':107C 'apifi':1A,9B,14B,37B,84C 'apify':6A,8A 'attack':51B,100C,145C 'author':180C,212C 'build':195C 'built':206C 'chang':209C 'close':43B,90C 'compani':46B 'compromis':23B,72C 'connect':128C,139C 'continu':156C 'could':140C 'credenti':24B,33B,73C,80C 'critic':152C 'detect':94C 'dozen':158C 'email':187C 'extern':130C 'follow':190C,232C 'found':136C 'github':199C,202C,208C,211C 'got':185C 'hesit':112C 'hour':228C 'inc':5A 'inc-apify-sxd1dj5j6749':4A 'incid':3A,10B 'individu':109C 'inform':167C 'instruct':192C 'integr':131C,223C 'intern':153C 'investig':58C,133C 'later':169C 'mortem':175C 'next':224C 'notifi':106C,177C 'novemb':29B,55B,65C,103C 'number':77C 'oauth':127C 'obtain':31B,75C 'ongo':60C 'open':203C 'organ':218C 'parti':20B,69C 'path':41B,88C 'per':214C,217C 'post':174C 'post-mortem':173C 'postmortem':231C 'precaut':124C,149C 'privat':198C 'prompt':220C 'provid':210C 'question':119C 'reach':114C 'reconnect':201C,221C 'relat':36B,83C 'relev':179C 'remedi':234C 'repo':200C 'report':15B 'revok':125C 'rotat':150C 'saa':11B 'secret':154C 'secur':2A,12B 'seen':48B 'share':166C 'sinc':53B,101C 'sxd1dj5j6749':7A 'third':19B,68C 'unauthor':18B,67C 'updat':56C,170C,225C 'us':117C,189C 'use':21B,70C,142C 'user':108C 'various':151C 'vector':146C 'vendor':13B 'within':226C","nicknames":[],"mitigations":[],"who_affected":"Apify users whose accounts were accessed during the 9 and 10 November incident. Apify is notifying affected users individually, so an email from Apify is the signal that your account was among them. Users who build Actors from private GitHub repos must reconnect GitHub.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apify"],"ptokens":["apify"],"labels":["apify","incident","medium","saas","security","vendor"],"campaign_type":null,"search_a":"'apifi':1A 'apify':6A,8A 'inc':5A 'inc-apify-sxd1dj5j6749':4A 'incid':3A 'secur':2A 'sxd1dj5j6749':7A","search_b":"'10':28B '11':54B '9':26B 'access':35B,40B 'account':32B,38B 'activ':52B 'apifi':9B,14B,37B 'attack':51B 'close':43B 'compani':46B 'compromis':23B 'credenti':24B,33B 'incid':10B 'novemb':29B,55B 'obtain':31B 'parti':20B 'path':41B 'relat':36B 'report':15B 'saa':11B 'secur':12B 'seen':48B 'sinc':53B 'third':19B 'unauthor':18B 'use':21B 'vendor':13B","search_c":"'10':64C '11':102C '6':227C '9':62C 'access':82C,87C 'account':79C,85C,215C 'activ':97C,161C 'actor':196C,205C 'addit':160C 'affect':107C 'apifi':84C 'attack':100C,145C 'author':180C,212C 'build':195C 'built':206C 'chang':209C 'close':90C 'compromis':72C 'connect':128C,139C 'continu':156C 'could':140C 'credenti':73C,80C 'critic':152C 'detect':94C 'dozen':158C 'email':187C 'extern':130C 'follow':190C,232C 'found':136C 'github':199C,202C,208C,211C 'got':185C 'hesit':112C 'hour':228C 'individu':109C 'inform':167C 'instruct':192C 'integr':131C,223C 'intern':153C 'investig':58C,133C 'later':169C 'mortem':175C 'next':224C 'notifi':106C,177C 'novemb':65C,103C 'number':77C 'oauth':127C 'obtain':75C 'ongo':60C 'open':203C 'organ':218C 'parti':69C 'path':88C 'per':214C,217C 'post':174C 'post-mortem':173C 'postmortem':231C 'precaut':124C,149C 'privat':198C 'prompt':220C 'provid':210C 'question':119C 'reach':114C 'reconnect':201C,221C 'relat':83C 'relev':179C 'remedi':234C 'repo':200C 'revok':125C 'rotat':150C 'secret':154C 'share':166C 'sinc':101C 'third':68C 'unauthor':67C 'updat':56C,170C,225C 'us':117C,189C 'use':70C,142C 'user':108C 'various':151C 'vector':146C 'within':226C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:46:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"apify:sxd1dj5j6749","url":"https://stspg.io/7sp049kjvxqb","severity":"medium","published_at":"2026-11-11T19:46:21+00:00","modified_at":"2026-11-12T11:08:31+00:00","first_seen_at":"2026-11-12T15:06:29+00:00","fetched_at":"2026-11-12T15:56:32+00:00","note":null}],"documents":[],"disclosures":[{"company":"Apify","domain":"stspg.io","url":"https://stspg.io/7sp049kjvxqb","kind":"statuspage","published_at":"2026-11-11T19:46:21+00:00","quote":"On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.","confidence":0.9700000286102295,"source":"statuspage","created_at":"2026-11-12T15:15:49+00:00","entry":"stolen-credential"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}