The incident occurred between November 9 and 10 and was detected the next day at 12:13 UTC. The company reacted by cutting off the attacker's access and launching an investigation to determine the impact. Apify's response involved invalidating internal credentials, rotating API tokens, and resetting all active sessions.
Apify is a Czech web scraping and browser automation platform for developers. Businesses use its services to collect data for websites, search results, and social media posts. The platform grew significantly with the generative AI boom, and reports having 80,000 customers, including Microsoft, Samsung, T-Mobile, Accenture, Siemens, the European Commission, and Roche. "On 9 and 10 November 2026, an unauthorized third party gained access to parts of Apify's internal systems," Apify said in an update on the incident.
