Apify’s Actor marketplace passes 100,000 tools in the week a breach hit customer accounts

Apify, the Prague company that runs a marketplace of scraping and automation programs called Actors, said on 10 November that its Store has passed 100,000 Actors and that the people who build them earn more than US$1.7 million a month. On 12 November it confirmed that an attacker had used a compromised credential on 9 and 10 November to reach customer accounts, and that some customers’ personal information or stored data was accessed.

The Store figures came in a press release for Run, Apify’s first user conference. The same release announced general availability of Server Actors and an upgrade to Apify AI, and said weekly Actor runs reached 267 million in October, up from 50 million at the end of 2025. Apify detected the intrusion at 12:13 UTC on 11 November, the day after the release, and cut off the attacker’s access.

What Apify sells

An Actor is a program that runs on Apify’s cloud: a scraper, a crawler, or an automation that drives a web browser. Jan Čurn and Jakub Balada launched the company in 2015 from the Y Combinator Fellowship in Mountain View, and Apify says it moved back to the Czech Republic in 2016 and raised a seed round. Its About page lists 80,000 customers, more than three petabytes of data processed a month and 116,301 Actors in the Store.

Apify says the Store’s Actors come from more than 4,500 independent developers and official partners. Server Actors, the new type, answer requests like an API instead of running as a one-off job, which Apify says suits AI agent tool calls. Agents connect through mcp.apify.com, and Apify says its plugin in Claude’s directory has more than 57,000 lifetime installs and over 12,000 active accounts. Agents without an Apify account can also pay for runs with a prepaid token bought over the x402, MPP or Skyfire payment protocols, Apify’s docs say.

How the money works

Customers pay a monthly plan fee that doubles as usage credit, then pay as they go. Compute is billed in compute units, where one unit is 1 GB of memory running for an hour. Most Store Actors charge per event, such as a result returned. Apify’s pricing page gives Instagram Scraper as an example: US$2.30 per 1,000 results, so 10,000 results cost US$23.

Plan	Per month	Included usage	Per compute unit
Free	US$0	US$5	US$0.20
Starter	US$19	US$19	US$0.20
Scale	US$199	US$199	US$0.16
Business	US$999	US$999	US$0.13

Builders who only publish can take a Creator plan at US$1 a month, which comes with a one-off US$500 of platform usage for the first six months but limits the Store to universal Actors, the pricing page says.

Under the Store publishing terms, a creator’s payout is 80% of the fees users pay for the Actor, minus the platform costs of those runs. Apify keeps the other 20%. Free-plan users bring no revenue, and Apify’s docs say it covers their platform costs. Payouts are invoiced after the end of each month, with a minimum of US$20 through PayPal or US$100 by any other route.

The terms carry forfeiture clauses. A payout withheld for 12 months because identity checks weren’t completed goes to Apify, and so does a balance that stays under the minimum for 12 months. An Actor that stops working as advertised stops earning until it’s fixed. Apify’s developer page says many developers earn over US$3,000. Spread evenly across 4,500 developers, US$1.7 million a month is about US$380 each.

Who funds it

Apify has raised little outside money. In April 2024 it took CZK 70 million, about €2.8 million, from J&T Ventures with existing investor Reflex Capital, Tech.eu reported. Čurn said then that the company’s previous investment came in 2019 and that it had grown from its own profits since. Tech.eu put 2023 revenue at €6.7 million with a profit of almost €1 million.

In a January interview with CzechCrunch, Čurn said annualised revenue reached US$31 million at the end of 2025, up from about US$13 million a year earlier, and that the company stayed profitable. He put active users at 56,000 and paying customers at 27,000. CzechCrunch also reported that Apify cut staff in 2022 after a planned large funding round fell through.

What Apify has said about the breach

Apify’s status page gives the sequence. An unauthorised third party used a compromised credential on 9 and 10 November to obtain a number of account credentials and reach related Apify accounts. Apify detected it at 12:13 UTC on 11 November and cut access. On 12 November it said it had notified the relevant authorities and then the customers whose personal information or stored data was accessed. Customers who got no email haven’t been identified as affected so far, the page says.

Apify revoked some OAuth connections to outside services, including GitHub, and rotated what it calls critical internal secrets. It says its investigation hasn’t found that those connections could be used as an attack vector. In its 13 November update it said API tokens are now stored only as hashes, and that it added network restrictions between internal services and stronger authentication on internal systems. It promised the next update within 72 hours and a post-mortem with the root cause within a week.

What customers were told differs by notice. BleepingComputer saw one notice saying Apify found no indication that account data stored on its platform was affected, and another telling customers to reset two-factor authentication because their 2FA codes may have been exposed, while passwords remain safe. SecurityWeek reported on a notice shared by a customer that lists names, email addresses, billing details, account activity, IP addresses, salted password hashes, 2FA recovery codes, phone numbers and authentication tokens tied to Google and GitHub sign-ins. It also lists only cardholder names, expiry dates and the last four card digits, not full card numbers. Apify hasn’t published that notice.

Apify hasn’t said how many accounts were affected, how the first credential was compromised or who the attacker was. It was also hit by an earlier incident this year. On 6 March 2026 an employee’s GitHub account was compromised in a malware campaign and the attacker force-pushed malicious code to several branches. Apify said branch protection stopped any change reaching a default or protected branch, and that it found no evidence customer data was affected.

For customers, Apify’s status page recommends setting Settings, General resource access to Restricted, because while it’s open anyone who knows a storage ID can read that storage. Customers who build Actors from private GitHub repositories need to reconnect GitHub from the Actor’s Change provider option, once per account and per organisation. The page says Apify will never ask for a password, 2FA codes or payment details.

How it compares

Rivals sell by different units, so the entry prices below aren’t like-for-like. Apify’s plan fee is usage credit, Firecrawl and ScrapingBee sell credits, Zyte charges per successful response and Bright Data per record.

Service	Entry paid price	What it buys
Apify	US$19 a month	US$19 of usage, then pay as you go
Firecrawl	US$19 a month (US$16 billed annually)	5,000 credits, one credit per basic page scrape
ScrapingBee	US$19 a month	75,000 API credits
Zyte API	Pay as you go, from US$0.13 per 1,000 responses	Simple sites, HTTP response; browser-rendered starts at US$1.01
Bright Data	US$1.50 per 1,000 records	Pay as you go; Scale is US$499 a month for 384,000 records

Sources: Apify, Firecrawl, ScrapingBee, Zyte and Bright Data. Firecrawl’s pricing page also announces a US$75 million Series B, against the roughly US$3 million Apify has disclosed raising since 2016. Apify’s design differs in one way: the creator sets each Actor’s price per event, and the customer’s plan sets the compute rate underneath.

Apify’s post-mortem is due within a week of its 13 November update. Its status page at status.apify.com carries each update as it lands.

Disclosure: I’m an OpenAI, Firecrawl and Devin ambassador.