Apple Account compromised 3 months ago — Apple cannot recover it, cannot delete it, and support says nothing can be done

I am posting this after three months of trying to resolve what appears to be a serious security issue with an old Apple Account of mine.

The account was created around 2014 and had not been actively used since approximately 2021. It predates two-factor authentication and relies on the old security-question system.

About three months ago, I started receiving security emails indicating suspicious activity on the account. On 29 June, I received notifications that the security questions had been changed. The changes appeared to originate from China, and the new security questions themselves are in Chinese. Other personal information associated with the account was subsequently changed as well, and at one point an iPhone 16 Pro Max that I have never owned appeared on the account.

I still have full control of the original email address associated with the Apple Account and can receive Apple's emails there. However, I cannot regain control of the account because Apple's recovery process asks me to answer the security questions — the very questions that were changed by whoever compromised the account.

I contacted Apple Support by telephone and explained the situation to a human support representative: the account had apparently been compromised, its security questions had been changed by somebody else, I still controlled the original email address, and I was willing to provide whatever information was necessary to establish that the account was mine.

The answer I received was, in essence, that nothing could be done. Apple Support could neither restore my access nor delete the compromised account because I could not pass the security questions.

This creates a rather extraordinary circular problem: in order to prove ownership of an account that has been compromised, I am required to provide security information created by the attacker.

I subsequently contacted Apple in writing, including through the relevant iCloud reporting channel, explaining the situation and asking for the case to be escalated. That written complaint has now been unanswered for 23 days.

Meanwhile, the underlying security issue has now been unresolved for two months.

I completely understand that Apple needs strict safeguards before restoring access to an account. I would not want Apple Support simply to hand over an account to somebody who claims to own it. But there must surely be a procedure for exceptional cases where the normal authentication mechanism is itself the thing that has been compromised.

What I find most difficult to understand is that there seems to be no meaningful escalation path to a human being with the authority to investigate such a case. Apple places enormous emphasis on privacy and security. Yet I have now spent two months receiving security notifications concerning an account associated with my identity, watching that account remain under somebody else's control, while being unable either to recover it or even to have Apple delete it.

I am not asking Apple to bypass its security procedures or simply take my word for it. I am asking for an actual human being to investigate a compromised Apple Account and provide an alternative ownership-verification procedure.

Has anyone here encountered a similar situation — particularly with an older Apple Account without 2FA where an attacker changed the security questions? If so, did you eventually find a way to get the case escalated beyond first-line telephone support and automated account recovery?

I would be extremely grateful for any advice on how to reach someone at Apple who can actually investigate this rather than simply send me back into the same automated recovery loop.