Apify rotates API tokens, prompts 2FA resets after breach

Apify's internal systems were accessed without authorization, triggering an emergency rotation of API tokens, revocation of third-party OAuth connections, and forced 2FA resets for users. This incident illustrates how compromised credentials or access tokens can serve as an attacker's entry point into internal infrastructure, bypassing other security controls. The rapid response — revoking tokens and OAuth grants — was appropriate, but the need to reset 2FA for users suggests authentication mechanisms themselves may have been exposed or weakened. Organizations must treat API tokens and OAuth grants as high-value secrets, subject to the same lifecycle management and monitoring as passwords. Even when user data appears unaffected, unauthorized internal access can undermine trust and expose sensitive operational systems.