"Your iPhone has been compromised"

Great info; thanks for posting.

These "leaks" seem to be defined as such by Apple. Apple is looking at our passwords and finding common ones, reused ones, weak ones, etc.. and putting us to work.

I don't believe this is true at all.

There are 3rd party sites that claim to have this data. Not Apple.

Terrabeat wrote:

Interesting. So even though it's Apple who is telling me about the leaks, you're saying I have to take the odds that not one of the 367 sites that Apple's told me I have a problem with will tell me independently that I've got a problem. I'm sorry. Can't do that.

Apple did not send you that message.

Terrabeat wrote:

Interesting. So even though it's Apple who is telling me about the leaks, you're saying I have to take the odds that not one of the 367 sites that Apple's told me I have a problem with will tell me independently that I've got a problem. I'm sorry. Can't do that.

Businesses are required to tell you if your credentials have been compromised. Some do, but many don’t. And many don’t know they have been compromised. However, if you reuse passwords your account on a site that was not compromised can still be hacked into using that reused password. For example, you log in to Widgets.com with your email address and the password “xyzzy”. Widgets.com was hacked, so your email address and “xyzzy” are now in the hands of criminals. They can now attempt to long in to every bank in the world using your email address and “xyzzy”, and, if they are lucky, they will find your bank where you reused “xyzzy” as your password. As they have computers, they can create scripts to try your email and “xyzzy” on all banks, all businesses, etc until they find one where you reused the password. And the scripts can run through all compromised email addresses and well as compromised passwords, even though there are hundreds of millions of compromised accounts.

The bottom line is that if you reuse passwords you will be hacked; it isn’t a question of “if”, it’s just “when”. One thing you can do to protect yourself is to use 2 factor authentication on all accounts that offer it. Another is to use very strong passwords, meaning at least 12 and preferably 20 random characters. Keychain can generate strong random passwords for you.

Just because a password is listed as breached doesn’t mean that all of your accounts were instantly compromised. It’s merely a flag to alert you potential issues. There’s not a quick fix to this problem, and the process to remove the threat can be tedious but worth it in order to protect yourself from something like identity theft.

You’ll want to identify the most important passwords to change first (banking, Apple ID, etc. ) and come up with unique passwords for them. Upgrade to two-factor authentication if available and store these passwords in a secure location. You can then move on to changing the rest of the passwords or deleting the accounts if necessary. There are also third party apps that may be able to help you manage this or you can reach out to Apple Tech Support (phone or chat) for guidance, questions, or concerns.