[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpgiiW0E9bw1Ok3mbdFeR330kRbBSgjfABWe3ikCbXNQ":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2c6d5fb9-72a5-41f7-97a1-afd4e0c9a823","Apify rotates API tokens, prompts 2FA resets after breach","apify-rotates-api-tokens-prompts-2fa-resets-after-breach-92e206","Apify has rotated critical internal secrets and revoked some third-party OAuth connections after detecting unauthorized access to its internal systems. [...]","Web scraping platform Apify experienced unauthorized access to its internal systems between November 9 and 10, 2026. The company has rotated API tokens, revoked third-party OAuth connections, and is prompting users to reset their two-factor authentication. Apify stated there is no indication that account data stored on its platform was affected.","Apify rotates API tokens and resets 2FA after detecting unauthorized access to internal systems.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fapify-rotates-api-tokens-prompts-2fa-resets-after-breach\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F12\u002FApify.jpg","2026-11-12T14:36:47+00:00","2026-11-12T15:00:24.717879+00:00",7,[17,20,23,26,28,30],{"name":18,"type":19},"Apify","vendor",{"name":21,"type":22},"Apify Proxy","product",{"name":24,"type":25},"OAuth","technology",{"name":27,"type":25},"2FA",{"name":29,"type":19},"Microsoft",{"name":31,"type":19},"Samsung","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[29,18,31],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":89,"name":90,"problem":91,"products":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":118,"name":119,"problem":120,"products":121},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"apify-breach-highlights-credential-and-token-security-risks","Apify Breach Highlights Credential and Token Security Risks","Apify's internal systems were accessed without authorization, triggering an emergency rotation of API tokens, revocation of third-party OAuth connections, and forced 2FA resets for users. This incident illustrates how compromised credentials or access tokens can serve as an attacker's entry point into internal infrastructure, bypassing other security controls. The rapid response — revoking tokens and OAuth grants — was appropriate, but the need to reset 2FA for users suggests authentication mechanisms themselves may have been exposed or weakened. Organizations must treat API tokens and OAuth grants as high-value secrets, subject to the same lifecycle management and monitoring as passwords. Even when user data appears unaffected, unauthorized internal access can undermine trust and expose sensitive operational systems.",[152,153,154,155,156],"CIS Control 5: Account Management (v8)","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF 2.0 RS.MI-02: Incident Mitigation","NIS2 Article 21(2)(j)","ISO\u002FIEC 27001:2022 A.8.5: Secure Authentication",{"NIS2 Article 21(2)(j)":158,"CIS Control 5: Account Management (v8)":159,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":160,"NIST SP 800-53 IA-5: Authenticator Management":161,"ISO\u002FIEC 27001:2022 A.8.5: Secure Authentication":162},"NIS2 Article 21(2)(j) explicitly requires the use of multi-factor authentication and secured communications, making the compromise event that necessitated forced 2FA resets a direct indicator of gaps this provision is designed to prevent.","CIS Control 5 requires managing the lifecycle of credentials and access tokens, including timely revocation when accounts or tokens are no longer needed or may be compromised — directly relevant to Apify's emergency token rotation.","This category calls for containing and mitigating incidents once detected; Apify's actions of revoking OAuth connections and rotating tokens represent the incident mitigation steps this control expects organizations to execute.","IA-5 governs the management of authenticators such as API tokens and MFA credentials, requiring their timely rotation and revocation upon evidence of compromise, which is exactly what Apify was forced to perform reactively.","A.8.5 requires organizations to implement secure authentication controls including managing tokens and MFA, failures in which are evidenced by Apify needing to mass-rotate credentials and reset authentication factors after the breach."]