Apify Security Incident
Apify, a web scraping and automation platform, has reported a security incident involving unauthorized access to internal systems and customer data. The incident has sparked debate on Hacker News, not only about the specifics of the breach—including revelations about insecure API token storage—but also concerns over transparency and the visibility of critical security news.
The Lowdown
Apify disclosed a security incident where an unauthorized third party gained access to parts of its internal systems between November 9th and 10th, 2026. The company detected the activity on November 11th and took immediate action to cut off access and launch an investigation, which is still ongoing.
Key updates and actions from Apify include:
- Incident Detection & Scope: Unauthorized access was detected on Nov 11th, with the attacker using a compromised credential to obtain account credentials and access related Apify accounts. This access path is now closed, with no further attacker activity detected since Nov 11th.
- Security Measures Implemented: API tokens are now stored only as hashes, network restrictions between internal services were added, and stronger authentication implemented on internal systems. The company is conducting a comprehensive security review and performing continuous log analysis.
- User Notifications & Recommendations: Affected customers whose personal information or stored data was accessed have been notified directly via email. Apify recommends users restrict access to their storages, be cautious of phishing, and, if prompted, reconnect GitHub integrations or other external services.
- Ongoing Investigation: Apify is continuing its investigation, including rotating critical internal secrets and notifying relevant authorities. They plan to publish a post-mortem with the root cause and remediation within a week.
Apify is committed to providing regular updates and encourages users with questions to contact support. The incident impacts their API, Actors, and General services.
The Gossip
Token Trouble & Tsk-Tsks
A significant point of contention was Apify's admission that API tokens 'are now stored only as hashes,' leading many commenters to question why this wasn't the default or standard practice beforehand. The sentiment was that API tokens should be treated with the same security rigor as passwords, implying that plain-text storage or weak hashing was a critical oversight.
Duplicity & Downvotes
The discussion included concerns about the story being a duplicate post on Hacker News. However, some users argued against removing the duplicate, suggesting that the severity of the incident warranted broad visibility. There were also accusations of potential downvoting by Apify employees to suppress the story, raising questions about transparency and how critical security news gets treated on the platform.
Bleeping Computer's Breakthrough
One comment highlighted a Bleeping Computer article providing additional details about the incident, specifically mentioning 'Apify rotates API tokens, prompts 2FA resets after breach.' This suggests that external news sources sometimes offer a more detailed or different perspective than a company's official status page, which can be valuable for the community.