---
id: "INC-apify-sxd1dj5j6749"
page: "https://infrastack.ai/live/INC-apify-sxd1dj5j6749"
kind: "incident"
aliases: []
title: "Apify: Security incident"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Apify", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apify", "incident", "saas", "security", "vendor"]
not_affected_if: ["no-apify-account"]
published_at: "2026-11-11T19:46:21+00:00"
first_seen_at: "2026-11-12T15:06:29+00:00"
updated_at: "2026-11-12T15:07:46+00:00"
sources: [{"source": "statuspage", "url": "https://stspg.io/7sp049kjvxqb", "first_seen_at": "2026-11-12T15:06:29+00:00"}]
exploit_sources: []
---

# Apify: Security incident

Link for people: https://infrastack.ai/live/INC-apify-sxd1dj5j6749 (this .md is for agents)

Apify reports that an unauthorized third party used a compromised credential on 9 and 10 November to obtain account credentials and access related Apify accounts. The access path is closed, and the company has seen no further attacker activity since 11 November.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apify affected range not listed fixed no fixed version listed

## How to check

- Check the Apify status page for updates on the investigation: https://stspg.io/7sp049kjvxqb
- Look for an email from Apify about your account and follow its instructions
- Review OAuth connections to external integrations in your Apify account

## Fix

- Reconnect GitHub for Actors built from private repos: open an Actor built from GitHub, choose "Change provider", select GitHub, and authorize (once per account and per organization)
- Reconnect any integrations if prompted

## Timeline

- 2026-11-11T19:46:21+00:00 confirmed by Apify (statuspage) https://stspg.io/7sp049kjvxqb "On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts."
- 2026-11-12T15:06:29+00:00 statuspage https://stspg.io/7sp049kjvxqb

## From the sources

Update: Our investigation is ongoing.

On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November. 

We are notifying affected users individually. Do not hesitate to reach out to us with questions.

We have:
- As a precaution, revoked some OAuth connections to external integrations. Our investigation has not found that these connections could be used as an attack vector.
- As a precaution, rotated various critical internal secrets.
- We continue with dozens of additional activities, about which we will share information in later updates and a post-mortem.
- We notified the relevant authorities.

For you:
- If you got an email from us, follow its instructions.
- If you build Actors from private GitHub repos, reconnect GitHub: open an Actor built from GitHub → "Change provider" → GitHub → authorize (once per account and per organization).
- If prompted, reconnect your integrations.

Next update within 6 hours, and a postmortem follows the remediation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_