Hacked appleid added new Security questions, apple says this is not possible...

Yeah well I can prove I'm the owner of the account to the same security-level as the account was created in, as I own the email associated with the account and there was apparently no further conditions back then. I also have the password to the account. And Apple certainly knows that there were no other security questions active at the time the account was setup once upon a time.

Thus, insofar as that logic applies, the account is mine equally much now, as it was when it was created. Nothing has changed, except that a script from China has added 3 security questions to the account but those were added today, and if Apple had any access to the Changelog of the accounts they would be able to see this and disregard these newly added questions and revert to the previous state of the account.

If they would have done that, it wouldn't matter who was the hacker or who wasn't, as the account would just be in the hands of the original email account again and not to any of the ones in a potential account dispute.

Their support even said that we can open an "email dispute process" where I prove I own the email the account is based on. And if successful, I get my email back for re-use at apple, but the account is then donated to the hacker, so not very useful. For the case of these old accounts, they should have extended that "email dispute process" to include the account as well.

As a funny side-note, I'm writing this as the hacked account. On the discussions.apple.com page, you can apparently login with the account in this state (i.e. username + password), as long as you just click Cancel when it then asks you for the security questions, it asks you if you want to upgrade to 2FA, you click Cancel again, and you're suddenly logged in to the Communities... doesn't help me of course.

Yeah I know about the 2FA, I use it on my primary AppleID accounts of course. I didn't even know I had this older account, and they never sent any emails to it about it requiring a 2FA upgrade either so had forgotten about it.

Like I wrote, you just get the "We don't have sufficient information to verify you" if you try to reset the security questions that the hacker inserted.

So since you can't log in fully, you can't enable any other 2FA, you can't "Upgrade your protection methods" or whatever that button was called, because that button also leads to the Security Questions box.

It's a kafkaesque nightmare and Like, currently nobody can log in to the account - the hacker can't (because I changed the password and I own the email) and I can't log in since it is setup using the hackers security questions.

I spoke with them on the phone, but the guy was unhelpful and basically said he couldn't do anything, if you can't log in to your account we are not going to help you. This would make sense for a 2FA account (and I fully agree on that policy!) but it does NOT make sense for a pre-2FA account pre-security questions account.

There is nothing on the account so I don't care personally but I like Apple's products in general and am a backend developer and CTO and therefore I just get incredibly annoyed by such oversights.

Like I wrote first, it amazes me that they don't have anti-hack protection tools in place in the first place. Who needs to change all parameters of their account the same 5 minutes, if it was untouched for 15 years? It would require a one line of backend code to put a quarantine on that process. Same quarantine that they apparently have if you try to switch an account from security questions to 2FA.

[Edited by Moderator]