Last updated: Nov 13, 2026. Apify's status page was rechecked on Nov 13. Its latest posted update was Nov 12 at 17:16 CET.
In the Apify breach, an unauthorized third party used a compromised credential on Nov 9 and 10 to obtain account credentials and reach related Apify accounts, Apify says. If you got no email, the company says your account has not been identified as affected so far, and that it will contact more customers if that changes.
That describes where its investigation stands, not what is safe for you. Below: what Apify has confirmed, and five checks that cost little whether or not an email arrived.
Apify breach: What the company has confirmed
What happened: Apify is a Czech web scraping and automation platform. Its about page lists 91,000 customers, which is the whole customer base and not the number affected. Apify's status page gives this sequence:
- Nov 9 and 10: the attacker used a compromised credential to obtain a number of account credentials and accessed related accounts.
- Nov 11, 12:13 UTC: Apify detected the activity and cut off access. It reports no attacker activity since Nov 11.
- Nov 12: Apify said it had notified the relevant authorities, and then the customers whose personal information or stored data was accessed. A postmortem follows the remediation.
As a precaution, Apify revoked some OAuth connections to external integrations, including GitHub, and rotated various critical internal secrets. It says its investigation has not found that those connections could serve as an attack vector. BleepingComputer saw customer notices saying affected customers' API tokens and Proxy passwords were rotated, and a letter advising a 2FA reset because codes may have been exposed, while saying passwords remain safe.
Why it matters: Apify has sent different notices to different customers. BleepingComputer saw one saying Apify found no indication that stored account data was affected, and another, sent to affected customers, about exposed 2FA codes. What you were told depends on which one reached you.
Apify has not published a count of affected accounts or named the compromised credential. It rotating its own tokens does not rotate the credentials you keep on the platform.
The defensive takeaway: Apify's instructions are short. Follow the email if you got one. If you build Actors from private GitHub repositories, reconnect GitHub: open the Actor, choose Change provider, then GitHub, then authorize, once per account and per organization. Reconnect other integrations when prompted.
Our advice: where the platform supports it, give each integration its own token, so you can cancel one without breaking the rest.
Sources: Apify status page; BleepingComputer; Apify about page
What to rotate after the Apify breach
Run these in order, email or no email.
- Look for Apify's email, spam folder included. If it arrived, follow its instructions. If not, treat Apify's "not identified as affected so far" as an investigation status, not a clearance.
- Reconnect integrations from the console. Apify says it will email some users to reconnect integrations, and breach notices attract copycat phishing. Type the Console address yourself instead of following a link, then reconnect GitHub and anything else it asks about.
- Reset 2FA if you were told to. Do it in Apify Console, following Apify's two-factor authentication guide, and enroll again.
- Replace your API token and Proxy password. Apify says it rotates tokens it finds affected, but you cannot tell from outside whether yours was. Per Apify's docs, the token sits on the API & Integrations page in Console. Generate a new one, update every script, scheduler and integration that uses it, and confirm the old value is revoked.
- Rotate what you stored inside Apify, starting with anything that costs money. Apify's shared responsibility docs describe secret inputs and secure environment variables as encrypted, and Apify has not published a list of what was accessed. Revoke each secret at the service that issued it, create a replacement, then update Apify. Check usage and billing at those providers for activity you don't recognize.
How Passwork shortens the next rotation
Rotation after a breach comes down to one question: which scripts, pipelines and people still use the old key? A secrets manager answers it from one record. In Passwork:
- One record per key. Each key or token lives in a vault record with its own access rights. The action history logs who changed or accessed it and when, with event export to your SIEM.
- Run-time fetch. Pipelines get the value through the Passwork CLI, so the secret exists only for the duration of the command and a changed record reaches every job on its next run.
- Rotation in the right order. Issue the new key at the provider, then update the record with
passwork-cli update, the same order as step 5. - Scoped access. Group-based access means a leaver is revoked once, not vault by vault, and service accounts give each pipeline scoped tokens of its own.
Passwork's guide to the secrets rotation lifecycle covers the full sequence.
Passwork Team
Alex Muntyan
Alex Muntyan
Table of contents
Table of contents
Self-hosted password manager for business
Passwork provides an advantage of effective teamwork with corporate passwords in a totally safe environment. Double encryption and zero-knowledge architecture ensure your passwords never leave your infrastructure.
Learn more