stereocourier

Q: iTunes store account hacked

I'm posting this just to share my story and get reactions. It's a little detailed but I thought worth sharing.

On November 23, 2010 I purchased a single song from the iTunes store for .99. I used store credit that I had from a gift card I received last year. It was the first purchase I had made since July 2010.

On November 25, 2010 I received a receipt for 2 more separate orders to my account. These were for over $50 in iPhones apps. Here's a sampling of some of the purchases:

1 eREAD isoshu, v1.5, Seller: ChengDu YueTong Internet Information Co. Ltd (17+)
2 Plants vs. Zombies, v1.3, Seller: PopCap Games, Inc. (iDP)
3 Monkey Island 2 Special Edition: LeChuck's Revenge, v1.1, Seller: Lucasfilm International Services Inc.
4 Asphalt 5, v1.2.6, Seller: Gameloft (9+)
5 Let's Golf!® 2, v1.0.1, Seller: Gameloft (4+)
6 Frames & FX for Photos, v2.5.1, Seller: Imikimi, LLC (12+)
7 Stenches: A Zombie Tale of Trenches, v1.0.1, Seller: Thunder Game Works (9+)

I do not have a credit card linked to my account, so these were made using my store credit.

I have only 1 computer authorized for my account (my personal home computer). I live alone and no one else touches my Powerbook but me. I also DO NOT own an iPhone, so I would have no interest in apps.

After I saw these bizarre purchases, I checked my account. I noticed 2 strange things: My account information had changed: My street address was correct, but city, state and zip had changed to: Towson, MD 21286-7840. I have never lived in Maryland. Also, I noticed that my password recovery answer had changed to "Murray" in response to a question about my mother's maiden name. That's decidedly NOT my mother's maiden name. Also, my birthdate had changed to an incorrect month and day.

I immediately changed my password and my recovery question/answer challenge.

I reported problems on all of these purchases and also contacted iTunes Account Support by e-mail.

Within 24 hours I received an e-mail from "Vicki" at iTunes Customer Support. She wrote:

"When reviewing over your account "name@domain.net" and the two reported orders, it shows that the content purchased within them was acquired from the computer that is currently authorized for your iTunes account. So I strongly advise that you do consult with those in your household regarding the purchases made, and the charges that resulted from those purchases."

Further:

"I have gone and reversed the charges for the two orders....You will see a store credit in three to five business days....Please note that this is a one-time exception, as the iTunes Store Terms and Conditions state that all sales are final."

I am pleased that Apple is refunding my store credit and replied so quickly.

However, it is simply impossible that these purchases were made from my computer. Again, my Powerbook is the only computer I have ever authorized to access my account, and I am the only person with access to it.

I am not sure how this happened. Any thoughts or similar experiences?

Powerbook G4, Mac OS X (10.5.8)

Posted on Nov 28, 2010 3:45 PM

Close

Q: iTunes store account hacked

  • All replies
  • Helpful answers

first Previous Page 128 of 131 last Next
  • by MadMacs0,

    MadMacs0 MadMacs0 Jan 10, 2014 11:56 PM in response to SC0TY999
    Level 5 (4,801 points)
    Jan 10, 2014 11:56 PM in response to SC0TY999

    SC0TY999 wrote:

     

    Apple you're seriously incompetent I don't think you're responsible enough to be holding people's sensitive information!!!!

    You do realize this forum is for users, so you need to find another means of communicating directly with Apple.

  • by SC0TY999,

    SC0TY999 SC0TY999 Jan 11, 2014 1:39 AM in response to MadMacs0
    Level 1 (0 points)
    Jan 11, 2014 1:39 AM in response to MadMacs0

    I'm heading over to the Apple store soon (Today), see what they have to say for themself!

  • by Basexperience,

    Basexperience Basexperience Jan 11, 2014 3:53 AM in response to SC0TY999
    Level 1 (20 points)
    Jan 11, 2014 3:53 AM in response to SC0TY999

    When you do, please point them to this discussion - it's amazing how many people have had their account compromised from Taiwan: it's no coincidence.

     

    I doubt you will get much beyond their usual stock suggestions for improving security -

     

    1. Change apple ID password - using highly random and secure password

    2. Change passwords on all associated email accounts - again with highly secure password

    3. Enable 2-factor auth on your apple ID account.

     

    If you do get some other details, or the guys in the apple store let slip that this is more widespread and they've seen more people report it to them, please come back and tell us.

     

    My wife's account hasn't been compromised since we changed the password, she's still got to enable 2 factor auth though. I've already done it, it's not tricky and it doesn't make anything awkward to use.

  • by Smr127,

    Smr127 Smr127 Jan 14, 2014 8:50 PM in response to stereocourier
    Level 1 (0 points)
    Jan 14, 2014 8:50 PM in response to stereocourier

    Has anyone had any problem with banking apps? Or credit cards associated with their accounts?

  • by MadMacs0,

    MadMacs0 MadMacs0 Jan 14, 2014 10:45 PM in response to Smr127
    Level 5 (4,801 points)
    Jan 14, 2014 10:45 PM in response to Smr127

    Smr127 wrote:

     

    Has anyone had any problem with banking apps? Or credit cards associated with their accounts?

    What do you mean by problem? If you think you are having a problem with something then this extremely old thread is that last place you should be posting. Start a new thread and describe your problem in detail and you will get far more help.

  • by Basexperience,

    Basexperience Basexperience Jan 14, 2014 11:00 PM in response to MadMacs0
    Level 1 (20 points)
    Jan 14, 2014 11:00 PM in response to MadMacs0

    Being haughty and dismissive usually helps. If you read the thread you'd know this thread is a continuing attempt to collate apple ID compromises from Taiwan, and it's had updates every week since it was started, hence you could call it "old".

  • by Basexperience,

    Basexperience Basexperience Jan 14, 2014 11:01 PM in response to MadMacs0
    Level 1 (20 points)
    Jan 14, 2014 11:01 PM in response to MadMacs0

    Then again, you might have a point.

  • by njb72,

    njb72 njb72 Jan 14, 2014 11:09 PM in response to Basexperience
    Level 1 (0 points)
    Jan 14, 2014 11:09 PM in response to Basexperience

    I completely agree. So rude and unhelpful.

  • by Smr127,

    Smr127 Smr127 Jan 14, 2014 11:10 PM in response to Basexperience
    Level 1 (0 points)
    Jan 14, 2014 11:10 PM in response to Basexperience

    No there are no problems with my accounts. It was a question asking if anyone has had problems. I'm just wondering how much access can be gained.

  • by Smr127,

    Smr127 Smr127 Jan 14, 2014 11:20 PM in response to MadMacs0
    Level 1 (0 points)
    Jan 14, 2014 11:20 PM in response to MadMacs0

    As for my account...I have a nickname I didn't create and a change of address. Not too much to be alarmed about but it did get me thinking.

  • by MadMacs0,

    MadMacs0 MadMacs0 Jan 14, 2014 11:26 PM in response to Smr127
    Level 5 (4,801 points)
    Jan 14, 2014 11:26 PM in response to Smr127

    For others, I've been following this conversation for over three years and believe I know exactly what it's about, but I don't understand what was meant by "banking apps"

    Smr127 wrote:

     

    No there are no problems with my accounts. It was a question asking if anyone has had problems. I'm just wondering how much access can be gained.

    So are you referring to on-line access to a banking account using a browser or some specialized application? The only currently known way to gain access to privacy information from either of those would be to gain physical access to a computer and install a keylogger along with the means to retrieve such informaiton. A more common way to harvest this information is by sending a phishing e-mail linked to a fake bank page and having the enter his login information. Such e-mails have been spotted for almost every bank in the world along with fake iCloud, AppleID, etc. phishing e-mails.

  • by MadMacs0,

    MadMacs0 MadMacs0 Jan 14, 2014 11:29 PM in response to Smr127
    Level 5 (4,801 points)
    Jan 14, 2014 11:29 PM in response to Smr127

    Smr127 wrote:

     

    As for my account...I have a nickname I didn't create and a change of address. Not too much to be alarmed about but it did get me thinking.

    So you are saying you were notified that changes were made to your account that you didn't make? If so you need to contact the bank immediately and get that taken care of.

     

    or are you talking about your iTunes account. That would almost certainly mean it's been hacked and used to purchase something with somebody elses credit card.

  • by Smr127,

    Smr127 Smr127 Jan 15, 2014 12:03 AM in response to MadMacs0
    Level 1 (0 points)
    Jan 15, 2014 12:03 AM in response to MadMacs0

    I see when I sign into my apple account it shows the apps I have on my phone. One of them for banking. Is there any way that someone would be able to see my (bank)account info from my apple account? Eg. Card number and password.

    I haven't responded to emails asking for any type of personal info. I wasn't notified of any changes to my Apple account but would they if they assumed it was me.

    The only reason I ever noticed this was, shortly after I synced my phone with my home computer I saw in phone settings "personal hotspot". I'll be the first to say that I know VERY little when it comes to my phone but anyway when I looked there, it had a password. I told myself that it's just something that's been preselected by Apple but I wanted to check my AppleID anyway and that's when I noticed the change of address and nickname.

  • by MadMacs0,

    MadMacs0 MadMacs0 Jan 15, 2014 12:22 AM in response to Smr127
    Level 5 (4,801 points)
    Jan 15, 2014 12:22 AM in response to Smr127

    Smr127 wrote:

     

    I see when I sign into my apple account it shows the apps I have on my phone. One of them for banking. Is there any way that someone would be able to see my (bank)account info from my apple account? Eg. Card number and password.

    No.

    I wasn't notified of any changes to my Apple account but would they if they assumed it was me.

    Normally you would be notified.

    The only reason I ever noticed this was, shortly after I synced my phone with my home computer I saw in phone settings "personal hotspot". I'll be the first to say that I know VERY little when it comes to my phone but anyway when I looked there, it had a password. I told myself that it's just something that's been preselected by Apple

    I'll let somebody with an iPhone familiar with using the personal hotspot, but Apple is not in the habit of preselecting passwords that would be different from your login or AppleID password.

    I wanted to check my AppleID anyway and that's when I noticed the change of address and nickname.

    Not good, but I'm a bit confused now. Where are you seeing the AppleID information? Is it in your iTunes store account or your iCloud or AppStore account. They can be the same but need not be.

  • by Smr127,

    Smr127 Smr127 Jan 15, 2014 12:37 AM in response to MadMacs0
    Level 1 (0 points)
    Jan 15, 2014 12:37 AM in response to MadMacs0

    Sorry. It's the iTunes Store. I thought they were all linked. Is there more passwords I should be changing with apple? The password for personal hotspot was just on my phone...not my iTunes account.

first Previous Page 128 of 131 last Next