If a client report is due while its automation needs attention, start with the dependencies. For a South Florida agency or creator business using Apify, the useful question is not simply whether a service loads. It is which connected jobs you can safely rely on next.
Apify's November 12 incident update, posted at 12:08 CET (6:08 a.m. Eastern), says an unauthorized party used a compromised credential on November 9 and 10 to obtain a number of account credentials and access related Apify accounts. The company says the access path is closed and it has detected no further attacker activity since November 11. Its investigation remains ongoing.
The company's first update says it detected the activity on November 11 at 12:13 UTC, cut off access and added monitoring. Apify also says it rotated critical internal secrets as a precaution, notified the relevant authorities, and plans further updates followed by a post-mortem once remediation is complete.
Start with the account notice, not assumptions
Apify says it is notifying affected users individually. Follow the instructions for your account rather than assuming a colleague's notification applies to yours. Avoid treating the absence of an error message as proof that a connection is ready for business use.
Make a short working list of the automations your team depends on. For each, record its owner, destination, last successful run and the business deadline it supports. Keep credentials out of that list. Prioritize work that feeds a client deliverable or a time-sensitive decision.
Check connections before rebuilding jobs
Apify's account settings documentation places API tokens, connected services, account-level integrations and Actor OAuth accounts under API & Integrations. Use that inventory to identify which connections need attention before changing the job itself.
The incident update says some external OAuth connections were revoked as a precaution, and that the investigation has not found those connections could be used as an attack route. For builds from private GitHub repositories, it instructs users to reconnect GitHub through an Actor's Change provider option, once per account and once per organization. Reconnect other integrations if prompted.
Treat replacement credentials as a controlled change
Apify recommends a separate API token for each service. Its documentation describes expiration settings and scoped permissions, and warns against sharing tokens with untrusted parties or using them directly in client-side code.
Ask the person responsible for an integration to document where its credential is used, without recording the secret itself in a shared ticket. Follow the account's security instructions when replacing credentials. Update the dependent integration and test a limited job before returning it to a production schedule.
Do not grant broader access merely to make an error disappear. Ask what the job actually needs and who can approve that access. If a client owns the connected account, route the change through that client's authorized administrator.
Check the result, not just the run indicator
After reconnecting, compare a small output with the expected destination and content. Confirm that the file, record or report reached the right place. Record the test time and who reviewed it, then decide which scheduled jobs can resume.
Keep operational recovery separate from the investigation. A successful test can support a decision about that particular workflow; it cannot establish what happened across the platform. Preserve unanswered questions for the vendor's next update rather than turning an incomplete incident report into reassurance.
Sources
Apify incident updates · Apify account settings · Apify API authentication and tokens
Key Facts for Owners and Search
Is the Apify investigation finished?
No. Apify's November 12 update says it remains ongoing, with a post-mortem to follow remediation.
Where can a team review its Apify integrations?
In API & Integrations within Apify's account settings.
Should every service use the same Apify token?
No. Apify recommends a separate token for each service.
What should teams with private GitHub builds do?
Does a successful workflow test close the incident?
No. A workflow test checks that workflow's output; Apify's investigation remains ongoing.
