Security AlertHigh
Apify rotates secrets after unauthorized access to internal systems
Nov 12, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Apify says an unauthorised third party got into parts of its internal systems on November 9 and 10. The company rotated API tokens, invalidated credentials and reset active sessions.
Key points
- Incident was detected the next day at 12:13 UTC.
- Apify revoked some third-party OAuth connections, including GitHub.
- API tokens and Proxy passwords were rotated.
- Apify says no account data stored on its platform was affected.
Why it matters
If your business uses Apify, you may need to reconnect integrations and reset access. Anyone who stored sensitive data or credentials in Apify AI should treat them as exposed and change them.
Who’s affected: Apify customers and integrations
What to do
- Watch for Apify email notices.
- Reconnect integrations only when told it is safe.
- Rotate any exposed credentials and reset 2FA if asked.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.