Apify Reports Intrusion Via Compromised Credential; Customers Asked to Reconnect GitHub

Apify has disclosed a security incident affecting its API, Actors and General components. An unauthorized third party gained access to parts of the company's internal systems on 9 and 10 November 2026. Apify says it detected the activity on 11 November at 12:13 UTC, cut off the access and started an investigation, according to its status notice.

The intruder used a compromised credential to obtain a number of account credentials, then accessed related Apify accounts. Apify says the access path used in the incident is closed and that it has detected no further attacker activity since 11 November.

As a precaution, Apify revoked some OAuth connections to external integrations, including GitHub, and rotated various critical internal secrets. OAuth connections are the grants that let a third-party service act on a user's behalf, and secrets are the keys and passwords that internal services use to authenticate to one another. Apify's investigation has not found that the revoked OAuth connections could be used as an attack vector. The company also says it prevented further unauthorized access and added monitoring to its systems.

Apify states it notified the relevant authorities. It has also emailed customers whose personal information or stored data was accessed. Customers who did not receive such an email have not been identified as affected so far, and the company says it will contact any additional customers directly if their affected status changes.

Users are being asked to take action in two cases. Those who build Actors (Apify's cloud programs for automated tasks) from private GitHub repositories should reconnect GitHub through the Change provider flow, once per account and once per organization. Users of integrations other than GitHub will be prompted to reconnect through a separate email notification. If the investigation finds that user tokens were affected, Apify says it will rotate them on users' behalf and notify those users.

Apify has said a post-mortem will follow remediation of the incident. No timeline for that document has been given.

In my view, the operational exposure for most customers is the reconnect step. For a single developer, re-authorizing a GitHub connection is a short task. For an organization with many private repositories feeding scheduled Actors, the one-per-organization requirement turns it into a coordination exercise touching build pipelines. Anyone maintaining those pipelines will want to confirm that the reconnected integrations resolve to the expected repositories.

The broader context here is the attack chain itself. A single compromised credential led to the harvesting of further account credentials. The subsequent rotation of internal secrets indicates that the company treated its internal secret store as within the scope of the incident, not only customer-facing data. For a platform that runs third-party code against customer data and third-party services, that is the category of exposure that matters most to its users.

In my view, the post-mortem is the next document to watch. A specific, technically detailed account of how the credential was compromised and how the intruder moved from there would give integrators and security teams a concrete benchmark for their own token hygiene. The stated sequence of containment, notification and remediation lets affected customers act on the information rather than wait for it.