Apify Breach: A Hacker Got Into Customer Accounts on the Web-Scraping Platform

What Apify Has Confirmed

Everything Apify has said publicly is on its status page. The attacker “used a compromised credential to obtain a number of account credentials and accessed related Apify accounts”. Apify detected the activity on 11 November at 12:13 UTC and cut off access.

As precautions, it revoked some OAuth connections to outside services, including GitHub, and rotated “various critical internal secrets”. It says its investigation “has not found” that the OAuth connections could be used as an attack vector, and that it has notified the relevant authorities.

On 12 November at 17:16 CET, Apify said it had notified customers “whose personal information or stored data was accessed”. If you didn’t get an email, your account hasn’t been identified as affected “so far”.

Apify hasn’t said how many accounts were reached, how the first credential was stolen or who the attacker is. It promised its next update “within 24 hours” and a post-mortem later. At 17:10 UTC on 13 November, a day after the last update, the page had nothing new.

What the Customer Notices Say

A notice seen by BleepingComputer says Apify rotated customers’ API tokens and Apify Proxy passwords, reset all active sessions and asked customers to reset two-factor authentication because their 2FA codes “may have been exposed”. It says passwords are safe.

A notice a customer shared on Reddit, reported by SecurityWeek, lists more:

• names, email addresses, IP addresses and account activity
• billing details, including cardholder names, expiry dates and the last four card digits (not full card numbers or security codes)
• salted password hashes, 2FA recovery codes and phone numbers
• tokens linked to Google and GitHub sign-ins

Apify hasn’t published the notice, and we haven’t seen one ourselves, so treat that list as one customer’s copy.

If it’s accurate, the recovery codes matter most, because one of them gets past the 2FA prompt. That fits Apify asking for a 2FA reset while calling passwords safe. The billing details are the next problem: a name, an address and the last four digits of a card make a fake invoice look very real.

The People in the Scraped Data

Apify runs a store of ready-made scrapers, which it calls Actors; its website counts 118,756 of them. Their results land in the customer’s account, in datasets that, in Apify’s own words, store “results from web scraping”. Anyone signed in to an account can open them.

Many of those results are about people. The Contact Details Scraper, one of the store’s popular Actors with 68,000 users, pulls email addresses, phone numbers and social media profiles from websites.

Old data doesn’t always go away. Unnamed datasets are deleted after the plan’s retention period, but named storages “are retained indefinitely”, so an account can hold years of results.

Apify notifies its own customers. The people in their datasets are a different matter: under Apify’s terms, the customer decides what happens to that data and whether anyone in it is told. Most people in a scraped dataset don’t know they’re in one, so a breach notice would be news to them twice.

If You Use Apify

• Read Apify’s email if you got one and follow it. No email means Apify hasn’t identified your account as affected so far.
• Reset two-factor authentication in Apify Console under Settings → Login & Privacy: disable it, enable it again with a fresh authenticator entry, and keep only the new recovery codes.
• Change your password too. Apify says passwords are safe, but the leaked list mentions password hashes. Change it anywhere else you used it.
• Update the rotated API token and proxy password wherever you pasted the old ones: scripts, n8n, Make, Zapier, MCP server settings, AI agents. The old ones no longer work.
• Reconnect GitHub if you build Actors from private repositories: open an Actor built from GitHub, choose “Change provider”, select GitHub and authorize, once per account and organization.
• Check Google and GitHub. If you sign in to Apify with either, review the apps that have access in that account and remove sessions you don’t recognise.
• Treat billing emails with suspicion for a while, especially “payment failed” messages and invoices with links.
• Delete datasets you no longer need. Named storages stay until you remove them.

EU Customers May Have Their Own 72-Hour Clock

Apify’s data processing addendum makes the customer the controller of personal data and Apify the processor. It obliges Apify to tell customers about a breach “without undue delay (and in any event within 72 hours)”.

The clock doesn’t stop there. If your account held personal data, Article 33 of the GDPR gives you, the controller, 72 hours after becoming aware of a breach to report it to your data protection authority, unless it’s unlikely to put people at risk. Article 34 adds a duty to tell the people themselves when the risk is high. For a notice that arrived on 12 November, the 72 hours run out around 15 November.

Regulators do enforce this part. Our GDPR fines tracker lists 107 fines that cite Article 33, the breach-notification rule.