November 12, 2026 · Identity and authentication
Apify’s November 12 update says a compromised credential enabled access to account credentials and related accounts on November 9–10. It says the access path is closed; the investigation continues. The update was posted at 12:08 CET (11:08 UTC), not the time of the intrusion.
The company is contacting affected users individually. It also revoked some OAuth integrations as a precaution, without finding that those connections were an attack vector.
Two recovery jobs, not one
For teams running automated jobs, a failed integration and a compromised credential are different problems. Reconnecting a service can restore a workflow. It does not, by itself, establish that an account’s recovery work is complete. Conversely, replacing a token does not prove that every scheduled job has been updated to use it.
Make a small recovery checklist rather than treating a successful login as the finish line:
- Verify the message first. Open the service through your known bookmark and compare any recovery request with the official incident page. Avoid entering secrets through an unexpected email link.
- Assign an owner to each dependency. Identify which jobs use the affected account or connection, where their credentials are configured, and who can update them.
- Separate restoration from validation. After an authorized change, test a low-risk job, inspect its result, and confirm that subsequent scheduled runs work. Do not broaden permissions just to make an error disappear.
- Keep an incident record without secrets. Record which connection was restored and when. Never paste tokens, recovery codes, or passwords into tickets.
What remains unknown
A working automation is evidence of operational recovery, not evidence that no data was accessed. Do not generalize one customer’s notification to every account. Treat any further account-specific instructions as a separate step to verify, rather than resetting unrelated services indiscriminately.
This is an operational explanation based on the provider’s notice, not an independent forensic investigation or a test of affected accounts.
Primary source: Apify’s incident timeline and updates.