Apify rotates API tokens, prompts 2FA resets after breach

Apify detected unauthorized access to its internal systems between November 9 and 10, 2026, leading to the rotation of internal secrets, API tokens, and customer 2FA resets as a precaution. The company revoked OAuth connections to third-party services, including GitHub, to mitigate potential downstream risks. While Apify stated there was no evidence of customer account data being compromised, customer API tokens and Apify Proxy passwords were rotated, and users were advised to reset their 2FA due to potential exposure.

AI-extracted · verify before operational use