Vendor incident, severity critical
Apify breached; API tokens, proxy passwords rotated and 2FA codes possibly exposed
Published
An unauthorized third party accessed parts of Apify's internal systems on November 9 and 10, 2026, and the breach was detected the next day. Apify rotated internal secrets, customer API tokens and Apify Proxy passwords, reset all active sessions, and revoked OAuth connections to external integrations including GitHub. Customers' 2FA codes may have been exposed, and Apify found no indication that account data was affected.
What's affected
- apifyevery version
Exposure window: to UTC.
What to do
- Reset two-factor authentication through the Apify Console
- Use the rotated Apify API tokens and Apify Proxy passwords and update them wherever they are used
- Reconnect OAuth integrations such as GitHub only after Apify notifies you it is safe
- Watch for the email from Apify about affected accounts
Secrets to rotate if you were affected
Platform tokens, GitHub tokens.
Check whether you were affected
To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it. The check is free and needs no account:
/pharon:check-incident apify-breach-2026-11Don't wait for the next one to reach the news. Pharon tells the team that owns the affected repo within minutes. Free for 7 days, no card.
Get alerted for the next oneReferences
Notice apify-breach-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.