GoKawiilApify rotates API tokens and resets 2FA after internal system breach
Apify detected unauthorized access to parts of its internal systems between November 9-10, discovered the next day, and responded by cutting off the attacker, rotating API tokens and Apify Proxy passwords, and resetting all active sessions. The company also revoked OAuth connections to third-party integrations like GitHub and is telling some customers to reset their two-factor authentication because their 2FA codes may have been exposed.
GoKawiil's interpretation of the reporting above, not reported fact.
Apify serves roughly 80,000 customers including major firms like Microsoft, Samsung and the European Commission, so a breach of its internal systems could have wide downstream exposure even though Apify says account data appears unaffected so far. The precautionary token rotation and 2FA resets suggest the company is still assessing the full scope of what the intruder could access.
- Unauthorized access to Apify's internal systems occurred November 9-10 and was detected November 11.
- Apify rotated API tokens, Apify Proxy passwords, and revoked some third-party OAuth connections including GitHub.
- Affected customers are being told to reset 2FA since codes may have been exposed, though passwords are reported safe.
YubiKey 5C NFC Security Key — After a breach like this, resetting passwords alone isn't enough — hardware-backed 2FA makes account takeovers far harder even if credentials leak again. The YubiKey 5C NFC supports FIDO2/WebAuthn and works across major platforms including GitHub, which Apify explicitly flagged in this incident. It's a simple, durable way to lock down developer and admin accounts going forward.”}} <!-- placeholder --> // ignore, returning proper JSON below只 {
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-12
Published there as: “Apify rotates API tokens, prompts 2FA resets after breach”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.