Apify Breach: How to Handle API Token Rotation After a Breach at a Tool Your Website Uses

Many websites and online stores depend on tools that their owners never log into. A scraper collects competitor prices every night. An automation pulls leads into the CRM. A plugin fetches reviews or search results. Each of those tools holds an API token, and when the company behind the tool is breached, that token becomes your problem.

That is what happened this week with Apify.

What happened at Apify

Apify is a Czech web scraping and browser automation platform. According to BleepingComputer, it reports about 80,000 customers.

On its status page, Apify says that on 9 and 10 November 2026 an unauthorized third party gained access to parts of its internal systems. It detected the activity on 11 November at 12:13 UTC and cut off access. In a later update it said the attacker used a compromised credential to obtain a number of account credentials and accessed related Apify accounts, and that it has seen no further activity since 11 November.

As precautions, Apify:

• rotated various critical internal secrets;
• revoked some OAuth connections to external integrations, including GitHub;
• rotated the API tokens and Apify Proxy passwords of affected customers and reset active sessions;
• told some customers to reset their two-factor authentication, because their 2FA codes may have been exposed, while saying passwords were safe.

The investigation is still ongoing, and Apify says a post-mortem will follow. It has not said how many accounts were affected. Apify has since said it has notified customers whose personal information or stored data was accessed in the incident, and that anyone who has not received an email has not been identified as affected so far.

Who is affected

You may be affected even if you have never heard of Apify, because the person who set it up may have been a developer or an agency. Typical places an Apify token lives in a website business:

• environment variables on your hosting or in a serverless function;
• automation tools such as n8n, Zapier or Make;
• a WordPress or WooCommerce plugin that imports products, prices or reviews;
• scheduled jobs that build SEO reports or lead lists;
• GitHub repositories that build Apify Actors.

If Apify rotated your token, the old one stopped working. Jobs that depend on it may now be failing quietly, and nobody notices until a report is empty or a price list is stale.

What to check this week

1. Find every place the token is stored

Ask your developer or agency for a list. Tokens are easy to copy into five places and forget four of them. A breach is the moment to make the list, not to guess.

2. Replace it, then rebuild

Create a new token in the Apify Console and update every place on the list. One developer who ran 33 Actors on Apify wrote on DEV Community that a secret environment variable only reaches a run through a new build, so Actors had to be rebuilt after the value changed. Test each job with a small run.

3. Reconnect integrations deliberately

Apify revoked GitHub and some other OAuth connections. Reconnect only the ones you still use, and give each the narrowest access it needs.

4. Reset 2FA if you were asked

If Apify's email told you to reset two-factor authentication, do it in the Apify Console. Do not click links in look-alike emails; go to the console yourself. Breach news is a favourite hook for phishing.

5. Check the bill

Look for runs, usage or proxy traffic you did not start between 9 November and the day you rotated. Stolen tokens are often used to run up charges rather than to steal data.

The dark-web angle: why tokens get stolen

API tokens and session cookies are valuable because they skip the password and often skip 2FA as well. Access to developer and cloud accounts is commonly traded on criminal forums and Telegram channels, alongside logs from infostealer malware. A token that works is worth more than a password that needs a code. That is why the fastest safe response to any vendor breach is to treat every token from that vendor as burned and replace it, even before the vendor confirms your account was touched.

This is the same pattern we covered in our guides on API security vulnerabilities, on multifactor authentication for website owners, and on AI agent security.

What to ask your developer

• Where is our Apify token stored, and has it been replaced everywhere?
• Did any scheduled job fail after 11 November?
• Do we use one token per service, so we can rotate one without breaking everything?

If you want an outside view of how your own site looks to an attacker, you can run a free website security scan with HackerMe.

FAQ

Was my data stolen in the Apify breach?

Apify says it is still investigating and will contact affected users directly. An early customer notice found no indication that stored account data was affected, but Apify later said it has notified customers whose personal information or stored data was accessed. If you did not get an email, still check your integrations, because a rotated token can break jobs either way.

Why did my Apify scraper or automation stop working?

If Apify rotated your API token, the old one stopped working immediately. Replace it everywhere it is stored and rebuild any Actor that reads it from a secret environment variable.

Should I rotate API tokens after any vendor breach?

Yes. Replacing a token costs minutes; leaving a stolen one active can cost money and data. Keep one token per service so rotation is quick.

We build HackerMe.

Sources: Apify status page (https://status.apify.com/), BleepingComputer, DEV Community account by an Apify customer.