Apify Breach Exposes Customer Emails, Billing Data and 2FA Codes

Apify, the Prague-based web scraping and automation platform, has confirmed that an attacker accessed customer account information during a security incident on 9 and 10 November 2026. In a notice sent to affected customers on 12 November, the company says the exposed data includes email addresses, names, billing details, the last four digits of payment cards and two-factor authentication settings, including recovery codes.

Apify says it has found no evidence that Actors, runs, datasets or other data stored on the platform were accessed. It has rotated every Apify API token and Proxy password, ended active sessions and reset 2FA settings. For email teams, two consequences matter now: affected users are exposed to convincing phishing built on real billing data, and any automation that feeds leads or data into an email platform through an Apify token has stopped working until the token is replaced.

What happened

Apify opened a security incident on its status page on the evening of 11 November. It said an unauthorised third party had gained access to parts of its internal systems on 9 and 10 November, that the activity was detected on 11 November at 12:13 UTC, and that access was cut off. As a precaution it revoked some OAuth connections to external integrations, including GitHub.

In an update on 12 November, Apify said the attacker had used a compromised credential to obtain a number of account credentials and had accessed related Apify accounts. The company says the access path is closed, that it has seen no activity from the attacker since 11 November, and that it has notified the relevant authorities. A later update the same day confirmed that customers whose personal information or stored data was accessed had been notified by email, and that users who received no email have not been identified as affected so far.

What data was exposed

According to the notice Apify sent to its customers on 12 November, the information viewed falls into four groups:

• Account details: profile photo, email address, name, username and social media handles.
• Usage details: subscription plan and billing history, internal usage metrics, browser and device information, and IP addresses of recent logins.
• Billing details: billing name, address, tax ID and billing email. For payment cards, only the last four digits, expiry date and cardholder name; Apify says full card numbers and security codes were not exposed.
• Authentication data: salted and hashed passwords, 2FA settings including recovery codes and phone numbers, and the tokens used for sign-in through Google or GitHub.

Apify warns that the contact and billing details could be used to send phishing that looks authentic because it contains information that is not public. It also says the attacker could have gained access to 2FA recovery codes, which is why it reset 2FA and asks users to set it up again.

Action checklist

• Reconfigure 2FA on your Apify account as described in Apify's separate instructions, and store the new recovery codes offline.
• Replace the Apify API token in every pipeline that uses it: scripts, Make or Zapier scenarios, and any integration that sends scraped or enriched contacts to your email platform.
• Reconnect GitHub if you build Actors from private repositories, and review the recent activity on your GitHub account.
• Treat Apify-themed email with suspicion: Apify says it will never ask for your password. Check links before you click and compare the sender domain with your usual Apify mail. Our guide on detecting phishing emails that pass every check lists the signals.
• Warn your finance team: fake invoices that quote your real billing address, tax ID and card digits are the most likely follow-up.
• Follow the status page for the scope of the incident and the post-mortem.

Sources

1. Apify Status: Security incident, updates of 11 and 12 November 2026 (primary source)
2. Apify: notice "Security incident update: Your account information was accessed", sent to affected customers on 12 November 2026

Related on SMTPedia

• How to detect phishing emails that pass every check
• SEGA newsletter breach at ARARA exposes 2.2 million email addresses
• DMARC record explained: policy, reports and roll-out