Apify rotates API tokens and asks users to reset 2FA after internal breach
Developers relying on Apify should check their integrations and re-enroll two-factor authentication while the investigation continues.
Apify, a Czech web scraping and browser automation platform, disclosed that an unauthorized party reached parts of its internal systems on November 9 and 10 and was spotted the next day at 12:13 UTC. The company cut the intruder's access, launched an investigation, invalidated internal credentials, reset all active sessions and rotated its API tokens. It also revoked OAuth links to external integrations, GitHub among them, and says those users will be emailed when reconnecting is safe. Apify has so far found no sign that account data on its platform was touched, but affected customers have had their API tokens and proxy passwords rotated and are being asked to reset their two-factor authentication, since 2FA codes may have been exposed. Developers who rely on Apify should check their integrations and re-enroll 2FA while the investigation continues.
Why it matters
The breach reached parts of Apify's internal systems, and the company has so far found no sign that account data on its platform was touched. Still, affected customers have had their API tokens and proxy passwords replaced, and 2FA codes may have been exposed, so the safe course is to treat existing 2FA as compromised until it is re-enrolled. Integrations that relied on OAuth links, GitHub among them, have been disconnected for now and will only be reconnected once Apify says it is safe. The episode is a reminder that a platform's own security incident can interrupt the tools users depend on, even when their data is not directly exposed.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.