icloud security breach - keep getting "subscribed to “ap ua gosd”" type messages

So, my icloud account was hacked yesterday.


I received the email"Your Apple ID (XXX ) was used to sign in to iCloud on an iPhone 5s."


I don't own an iPhone and never sign in the the iCloud.


So, I logged in to my account on my mac, and could see a couple of connected devices that weren't mine.


I removed these accounts, immediately changed my password and set up 2-step verification.


However, now I keep getting emails that saying that invitations to a shared album have been accepted.

This is an album that I hadn't created.

For example:

"**** subscribed to “ap ua gosd”The invitation sent to **** was accepted by ****@qq.com.

If you did not intend to invite this person, you can remove them from your shared album."


However, I cannot see this shared album anywhere, when I log in to my icloud account.


Should I be alarmed by these emails, and is there anywhere else that this newly created album (presumably created by the hackers) could be stored?


[Personal Information Edited by Moderator]


Posted on Aug 23, 2022 8:44 AM

Reply
Question marked as Top-ranking reply

Posted on Aug 23, 2022 9:12 AM

Your apple id address is still known to them , you have changed Apple ID password and set up 2FA .

The other devices that were synced from iCloud.com have been removed .

Still they can send a shared album ( their iPhone / Mac / iPad are signed in with different Apple ID and password , might be on the different network ) that will be visible in photo application of Mac and never from iCloud.com

A mail is always received when photo albums are shared in mail application ( IMAP account ) see the article Share iPhone photos with Shared Albums in iCloud - Apple Support

Don't accept the invitation and click on the link , they can't grab your account credentials , however Apple ID will be always known to them .


Similar questions

2 replies
Question marked as Top-ranking reply

Aug 23, 2022 9:12 AM in response to sylvien

Your apple id address is still known to them , you have changed Apple ID password and set up 2FA .

The other devices that were synced from iCloud.com have been removed .

Still they can send a shared album ( their iPhone / Mac / iPad are signed in with different Apple ID and password , might be on the different network ) that will be visible in photo application of Mac and never from iCloud.com

A mail is always received when photo albums are shared in mail application ( IMAP account ) see the article Share iPhone photos with Shared Albums in iCloud - Apple Support

Don't accept the invitation and click on the link , they can't grab your account credentials , however Apple ID will be always known to them .


This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

icloud security breach - keep getting "subscribed to “ap ua gosd”" type messages

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.