# Apify Discloses Account Data Breach

Apify reported that an unauthorized party used a compromised credential on November 9–10, 2026, to access parts of its internal systems and affected customer accounts; Apify detected and cut off the access on November 11. The notice described exposure of profile, usage, billing, and authentication-related information, including 2FA recovery codes and Google or GitHub sign-in tokens. It said full payment-card numbers and security codes were not exposed; the separate claim that payout details were accessed is not substantiated by the provided details. Government buyers and contractors using Apify should treat this as a third-party SaaS security incident and assess potential exposure through accounts, integrations, and connected repositories.

- Organizations using Apify can verify whether they received a direct notification, review account activity, and revoke or rotate potentially affected credentials and integrations.
- Procurement and security teams should assess whether data stored in Apify or connected repositories requires additional incident response, and consider the incident when evaluating the platform’s risk to their operations.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 12, 2026

### Vendors
- Apify (SaaS platform provider affected by the breach)

### Key Quotes
> Authentication data: Encrypted passwords (hashed with salt) that cannot be read or compromised, two-factor authentication (2FA) settings (including recovery codes and phone numbers), and authentication tokens used for sign-in via Google or GitHub.
> — Original poster (quoting the email received from Apify)

> On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.
> — Original poster (quoting Apify’s announcement)

### Sources
- [Apify Data Breach: Unauthorized access to user PII, auth data (hashed passwords/2FA), and payout details.](https://www.reddit.com/r/cybersecurity/comments/1xuh7qh/apify_data_breach_unauthorized_access_to_user_pii) - reddit-cybersecurity