Applies to: Anyone with an iCloud/Apple ID account
Updated: 2020-04-29. This post was originally written about a ‘hack’ which some criminals were going to do with people’s data back in 2017. This ‘hack’ never actually happened. However, if you tend to re-use your password across multiple websites then now is a good time to make sure each website has a different password. Password managers can help with this (see below).

What happened:

  • A group of hackers said they could get into 250 million iCloud (Apple ID) accounts
  • Apple said this wasn’t true
  • Apple said they had not had any account details stolen
  • The hackers said they were going to delete all user data in those accounts by a particular date (if a ransom wasn’t paid)
  • The hackers claimed to have “proved” with a small set of accounts that they really did have these details (this didn’t actually prove anything other than they could get into those few accounts)
  • The hackers said data would be deleted soon so you needed to change your password asap
  • In unsurprising news, the ‘hack’ which the criminals were going to do didn’t happen.

How worried should I be?

Evidently, this ‘hack’ never happened. And if you don’t reuse passwords across websites (you should never reuse passwords across different websites) then the general feeling is you should be fine. BUT are you willing to risk it? I would change my password if I were you.

AND

Maybe think about using a password manager, but change your password first.

How can I protect myself?

This WIRED article explains how to change your password and enable 2-factor login (to make things extra secure). It also goes into a little more details on what the hackers are claiming for those who are interested

To change your password: Head over to your Apple ID page, sign in, and click Change Password. https://appleid.apple.com/#!&page=signin

One step further

You’ve changed your password, set up 2-factor login, used a Password Manager and prayed to the god of IT security for good measure… then the next thing to do is to register your email address using the “Notify Me” button on this website https://haveibeenpwned.com/ . (see this post for more details and why you should do this)

Stay Safe
Mike 🙂