Apify says it now stores API tokens only as hashes and has tightened internal authentication and network access following its security incident. The measures appear in a November 13 update posted at 17:36 CET.
The incident was first disclosed on November 11. Apify says an attacker used a compromised credential on November 9 and 10 to obtain account credentials and access related accounts. Customers whose personal information or stored data was accessed have been notified, but the investigation remains open.
Users should set General resource access to Restricted in Console and follow any individual notification. Open storage can be read by anyone who knows its ID. The access-control documentation also explains that individual resource settings can override the account default, and signed sharing links remain possible.
The hash-storage change should not be interpreted as confirmation that every previously obtained credential has been revoked. Apify’s public timeline does not announce a universal rotation of customer tokens. It also warns users to watch for phishing and says a root-cause report will follow.
