Apify breach prompts API token rotation and 2FA resets

Apify detected unauthorized access to its internal systems and responded by rotating critical internal secrets, prompting customer 2FA resets and revoking some third-party OAuth connections.

Disclosed 12 November 2026 · Record updated 12 November 2026

Impact

Unauthorized access to Apify's internal systems led to rotation of API tokens, forced customer 2FA resets, and revocation of some third-party OAuth connections.

Our coverage

Incidents

Apify rotates API tokens and forces 2FA resets after breach

The automation platform revoked some third-party OAuth connections after detecting unauthorised access to its internal systems, BleepingComputer reported on 12 November 2026.

12 Nov 2026

Sources

bleepingcomputer.comhttps://bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach