Apify rotates API tokens and forces 2FA resets after breach

# Apify rotates API tokens and forces 2FA resets after breach

https://gcdradar.vercel.app/incidents/apify-rotates-api-tokens-and-forces-2fa-resets-after-breach · AIR-2026-1930 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Severity 3 due to confirmed unauthorized access and credential compromise
- Fix status: No fix needed
- First reported: 2026-11-12
- AI role: No AI role
- Products: Apify

## Summary

Apify detected unauthorized access to its internal systems and responded by rotating API tokens and forcing 2FA resets for affected accounts. The breach prompted immediate credential revocation and OAuth connection removal.

## What to do

Rotate all API tokens, enforce 2FA for all accounts, and audit for further compromise.

## Latest updates

- 2026-11-12: Apify rotates API tokens, prompts 2FA resets after breach (https://bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach)

## Sources

- 2026-11-12 BleepingComputer: Apify rotates API tokens, prompts 2FA resets after breach https://bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.