2026 Apify — stolen login; hashes, tokens, billing data
Data compromised
Status page: customers whose personal information or stored data was accessed were emailed. SecurityWeek, citing a Reddit copy of a customer letter: names, emails, billing, activity, IPs, salted password hashes, 2FA recovery codes and phones, Google/GitHub sign-in tokens, cardholder name, expiry and last four (no full PAN or CVV). API tokens and Proxy passwords rotated. Treat the Reddit letter as one customer copy, not a published inventory. recordsAffected 0.
Technical writeup
Status page remains primary. SecurityWeek 13 Nov field list is a customer-letter copy. Do not use 91,000 as a census.
Root cause
On 9 and 10 November 2026 an unauthorised party used a compromised credential, obtained further account credentials and accessed related Apify accounts. Detected 11 November at 12:13 UTC and cut off. Authorities notified. 91,000 customers is a marketing figure, not this census.