Roche

Apify Rotates API Tokens and Prompts 2FA Resets After Detecting Unauthorized Access

Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems between November 9 and 10, 2026. The incident was identified on November 11 at 12:13 UTC, prompting the company to immediately cut off the attacker's access and launch an investigation. As part of its response, Apify invalidated internal credentials, rotated API tokens, reset all active sessions, and revoked OAuth connections including those linked to GitHub. The Czech web scraping and browser automation platform, which serves 80,000 customers including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission, and Roche, found no indication that stored account data had been affected. Impacted customers received notifications that their Apify API tokens and Apify Proxy passwords were rotated, while also being advised to reset two-factor authentication through the Apify Console due to potential exposure of 2FA codes. Passwords themselves remain safe according to the company's communications.