Apify rotates tokens and forces 2FA resets after breach

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Apify platform users with API tokens or OAuth connections

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild

What to do

The Brief

Apify detected unauthorized access to its internal systems.
Apify rotated critical internal secrets and revoked some third-party OAuth connections.

If you use Apify, your API tokens and OAuth connections may have been changed or revoked, and you may need to reset two-factor authentication.

Checklist · 2 of 10 yes

Yes	Hits tech teams	Judgment: Apify is a web scraping and automation platform that developers build on and run.
No	Core infrastructure	Judgment: a single developer platform is not core infrastructure like GitHub or OpenSSH.
No	Popular tool	Judgment: Apify is a mid-sized developer platform, not a widely used mainstream tool.
Yes	Exploited in the wild	BleepingComputer: Apify detected unauthorized access to its internal systems, so an intrusion occurred.
No	Public exploit	BleepingComputer: no exploit code or proof-of-concept is mentioned; the article covers breach response only.
No	Remote, no login	BleepingComputer: the entry vector is not described, so unauthenticated network access is not reported.
No	Full takeover	BleepingComputer: only unauthorized access to internal systems is reported; no code execution or admin takeover is stated.
No	Secrets exposed	BleepingComputer: Apify rotated critical internal secrets, but the article does not say they were stolen or exposed.
No	Supply chain	BleepingComputer: no compromised package, update, build pipeline or signing key is reported.
No	No fix yet	BleepingComputer: this is a breach, not a vulnerability; secrets were rotated and connections revoked.

First seen 1h ago · 1 source · Full story page · How tiers are decided