On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts. This access path is closed, and we have detected no further activity from the attacker since 11 November.

We are notifying affected users individually. Do not hesitate to reach out to us with questions.

We have:
- As a precaution, revoked some OAuth connections to external integrations. Our investigation has not found that these connections could be used as an attack vector.
- As a precaution, rotated various critical internal secrets.
- We continue with dozens of additional activities, about which we will share information in later updates and a post-mortem.
- We notified the relevant authorities.

For you:
- If you got an email from us, follow its instructions.
- If you build Actors from private GitHub repos, reconnect GitHub: open an Actor built from GitHub → "Change provider" → GitHub → authorize (once per account and per organization).
- If prompted, reconnect your integrations.

Next update within 6 hours, and a postmortem follows the remediation.