Is this recent FLOOD of data leaks from Apple iphone security breach?

Is this recent FLOOD of data leaks from Apple iphone security breach?

I had more notifications over the last week of data leak of passwords.

I have a hierarchy of passwords , using completely unique passwords for banking. And yet my banking password, my tax account password & a unique just created ( last 3 week) account with unique password with my secondary email (infrequently used) has ‘appeared’ in a data leach over the last week. I did the ios update as soon as able once announced- on all devices, but these highly secure websites with unique passwords have supposedly all had data leaks over the same week- but there is not report of them being breached along with many other sites with less secure/ unique passwords - all this week. This seems a little coincidental. Is anyone able to explain why it’s not an Apple breach? I’ll also say I only recently used the banking password recently on the Apple banking app - used it for years but never saved it on the Mac but was requested by the app to save it about a fortnight ago - again unique password- now I’m to believe the bank’s had a data breach. Apple iphone is the only common denominator.

iPhone SE (Gen 3)

Posted on Aug 25, 2022 7:44 AM

Reply
Question marked as Top-ranking reply

Posted on Aug 28, 2022 8:34 AM

The patched vulnerability could have been used to access your phone; however, the best analysis from cybersecurity experts says that this was a generally unknown vulnerability, and was probably only accessed by major spy organizations such as NSO Group and their competitors. All of them price their hacking products in the millions of dollars and sell them only to governments. So if you are important enough so that a government agency would be willing to spend $millions to hack your phone you should be concerned; otherwise that is not what has happened to you. And if that was what really happened, why would they give themselves away by accessing your banks, rather than just continue spying?


What is much more likely is that your Apple ID (not your phone) was hacked; that would give access to your passwords if someone knew your Apple ID, it’s password, AND you did not have 2 factor authentication on your Apple account. You can check to see devices that have access to your Apple ID account→Checklist: If you want to see if anyone else has access to your device or accounts - Apple Support


If you have 2 factor authentication on your account you would have received a notification and request to authorize access if someone tried to log in to your Apple ID. Note that to get this far they would have had to already know your Apple ID password; and unless it was very obvious, Apple would temporarily lock your account if more than 5 attempts were made to guess it.


Another possibility is you got a link in a text or email to a spoof site that mimicked your bank’s site, and you used that link thinking it was your bank. A good friend of mine just fell for that one, and came close to losing $100,000 until he got suspicious and called me for advice. But the site was very well done, and even was able to call him back from the bank’s 800 number when he requested a customer service callback to discuss the fraud the text warned him of.

Similar questions

6 replies
Question marked as Top-ranking reply

Aug 28, 2022 8:34 AM in response to SuzBuz

The patched vulnerability could have been used to access your phone; however, the best analysis from cybersecurity experts says that this was a generally unknown vulnerability, and was probably only accessed by major spy organizations such as NSO Group and their competitors. All of them price their hacking products in the millions of dollars and sell them only to governments. So if you are important enough so that a government agency would be willing to spend $millions to hack your phone you should be concerned; otherwise that is not what has happened to you. And if that was what really happened, why would they give themselves away by accessing your banks, rather than just continue spying?


What is much more likely is that your Apple ID (not your phone) was hacked; that would give access to your passwords if someone knew your Apple ID, it’s password, AND you did not have 2 factor authentication on your Apple account. You can check to see devices that have access to your Apple ID account→Checklist: If you want to see if anyone else has access to your device or accounts - Apple Support


If you have 2 factor authentication on your account you would have received a notification and request to authorize access if someone tried to log in to your Apple ID. Note that to get this far they would have had to already know your Apple ID password; and unless it was very obvious, Apple would temporarily lock your account if more than 5 attempts were made to guess it.


Another possibility is you got a link in a text or email to a spoof site that mimicked your bank’s site, and you used that link thinking it was your bank. A good friend of mine just fell for that one, and came close to losing $100,000 until he got suspicious and called me for advice. But the site was very well done, and even was able to call him back from the bank’s 800 number when he requested a customer service callback to discuss the fraud the text warned him of.

Aug 25, 2022 5:35 PM in response to SuzBuz

There have been a number of breaches of other sites, including banks. What Apple is reporting is IDs and passwords that have been compromised in those other breaches. Here are some recent ones→https://firewalltimes.com/recent-data-breaches/. the Question Pro breach is a really serious one, because many financial institutions contract with Question Pro for their data collection and surveys.


Apple does not store your passwords, so if there was a breach of Apple (and none have been reported) only your Apple ID password would be compromised. The passwords stored on your phone are not accessible by Apple.

Aug 25, 2022 5:27 PM in response to WheelieNick

Thanks Nick, would you be able to explain what was involved, because it's quite a coincidence that these highly secure sites unique passwords appeared in a data leak & these high security site (banking & a country's taxation portal) would be leaked in the same fortnight. Along with a Facebook unique password that was made only 3 weeks ago so can't have been available before that for anyone because it didn't exist. Along with these unique highly secure sites that haven't reported a breach nor listed as a breached company over the last weeks, month nor years, almost all other sites are listed. I've had the same banking password for years because I memorised it - didn't save it anywhere. About a month ago I had to put the password into my phone to use the banking app. This just seems TOO oddly coincidental. So if you can tell me if the security issue allowed unauthorised access on details on my phone then surely the first place hackers would look is in the iPhones "passwords" then it would be handed to them on a plate.

The reason for asking is this is hours of work to change every different password I have (like I said every password is listed not just one or two). I've experience a data leak before & it's corresponded with a company report of breach eventually but this is every different password for almost every site in my password list. Obviously I've now changed all banking / credit card sites- although I usually don't allow my carditis card to be saved - I type it in each purchase. BUT it's still many hours to fix & if the vulnerability was Apple Passwords themselves then that is a whole new level of problems.

Thanks SB

Aug 27, 2022 8:16 PM in response to Lawrence Finch


Can some one just tell me if the patched vulnerability could have lead to someone accessing the "passwords" saved in the "passwords" section of my new iPhone SE? This is the question I've now asked 3 times so it would be nice to know the answer to this question. I really think this question would be important for many people actually.


Lawrence , thanks for your answer but I have contacted the Bank & awaiting answer for Government site. I had already checked the "have been pwned" sites & lists of data breaches. If they were listed, then of course I would count this all as extremely bad luck - unique passwords from high security sites & new (few weeks old) unique password from less secure - all being hacked in the same time frame. None of the less secure sites that I use report a recent breach, but for twitter & weirdly my unique password for twitter isn't listed as being exposed! Approximately 40 sites are listed including some for which I've made very unique passwords are reported as in the data leak, but none of theses sites are listed in recent breaches. The Bank had a breach about 6 years ago & hence attempted to improve security since then. So while they all could have been breached in the same time frame it is odd that: 1) they have ALL been breached recently & 2) none are on any breached lists I can find & it happened within days of the recent iOS update for security reasons. Again no-one is responding to the question I keep asking - that is if I couldn't update the "security" vulnerability patch fast enough (as soon as it was reported in the press here) then COULD the "passwords" data on my Apple iPhone have been accessed because they ARE saved on the iPhone? That is why there is a section in the settings called "passwords". This is where the passwords ARE kept. I am not an expert hence why I came to this site, but I also am usually a logical thinker & it just seems too much of a coincidence. 1) Security vulnerability found in Apple iOS, 2) Apple puts out a public warning, 3) suddenly MOST my DIFFERENT passwords for approximately 40 sites, including some with quite high security - including the Country wide system storing Residents' taxation, banking & medical information, have all been breached in the same time frame, 4) YET none are on the publicly available breach lists. (& my bank reports no link to Question Pro either).

Can some one just tell me if the patched vulnerability could have lead to someone accessing the "passwords" saved in the "passwords" section of my new iPhone SE? That would be very helpful for future planning & I'm sure I'm not the only person concerned.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is this recent FLOOD of data leaks from Apple iphone security breach?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.