My devices have been hacked. What do I do?

I'm in Ballarat, Victoria. My ipod just stopped suddenly at about 1:30 or 2am (in the middle of my audiobook!) and started beeping loudly (which was annoying, since the kids are sleeping). Am backing up my photos to the computer now, and then I'll try restoring to factory settings. Sigh!!!!!

Im in Brisbane Queensland and my iphone was set to silent and at 1:30am 27/05/14 just in last hour my phone started beeping loudly and said it had been hacked by Oleg Pliss as well. This is the only forum online that has any information so far - so thanks everyone for writing otherwise I would not have known what to do at all!!! Cheers

So after a long chat to Telstra, and then Apple...

Apple gave me a case number, and told me to contact the local authorities. They were super helpful. They've also escalated the issue to account security who will contact me later today.

Telstra, bleugh. Not much there.

Apple also said: The passcode can be removed via recovery mode restore. However, it is recommended to wait until the iCloud activation lock is lifted before doing that, because once you restore, it will just go to this screen and you will have to restore again.

Was woken up by this same thing a few of hours ago (in NSW).

My iPad & iPhone both had pass codes on them so I was able to go into the iCloud & Find My Phone apps and turn them off. I've also deleted the apps and deactivated the accounts from there and not receiving the messages anymore.

When I logged on to my mac, got the same message via iCloud/Find My Mac Book, turned both services off and deactivated.

I was also able to change my Apple account password and remove my credit card details, however I can't get into my iCloud account via the web: password isn't working, tried the reset password route but my DOB and email has been changed in their records, to who knows what.

I'm fine to not use iCloud anymore, I didn't use it for much anyway, but I have two questions:

1) What damage can be done by not being able to access my iCloud account if I don't want to use it anymore anyway and there was very minimal data in the account: some notes, contacts, photos...

And

2) seeing as I had pass codes and was able to deactivate the iCloud/Find My iPhone, is there a need for me to restore my devices like everyone else seems to be doing?

Thanks!

I'm in Melbourne - this woke me up at 4.30 (the least the hackers could do is not play an obnoxious sound....)

I found this article http://www.nltimes.nl/2014/05/21/apple-icloud-hacked-dutch-gang/, so I wonder if it has anything to do with this incident.

There is no information anywhere else, and only one small new article - it seems very strangeas this seems to have been happening for over 24 hours - so thanks for everyone who put up advice here!

Yep 3 devices taken down in Brisbane. Really annoying at 5am.

The Dutch hacker story would have to be related in some way or form. Either they're using their method or someone else has got their hands on it.

I feel as if I should just wait it out as I'm sure Apple will issue a statement and give further details and support on it very soon. That is the hope anyway.

I wonder if it has anything to do with this incident.

No, it does not. The Dutch hacking story involves hackers who have found a way to unlock stolen devices running iOS 7 that have been permanently locked by Find My iPhone. This only applies to devices in their possession, and does not give the hackers access to the Apple ID or the ability to remotely lock iOS devices.

This has happened to me too in Brisbane, woke me up half an hour ago. Freaking out as when I opened my laptop it had the same message "Device hacked by Oleg Pliss. For unlock device" with the Find My iPhone icon.
Freaking out so have changed my apple ID and need to turn on two-step verification.... could this have anything to do with the fact that I updated my OSX yesterday?

Thanks for the lengthy post with plenty of great information thomas_r. It contains lots of great information.

I was also hit on 4 of 5 devices. Two with no issue as they already had pass codes on them. The other two, that did not have pass codes have now been locked by our friend Oleg.

I am in London on holidays at the moment, and must have been one of the first to see it. I took both devices straight to the local Apple Store, who really hadn't seen anything like it. They got me on the chat to Apple immediately, it took 25 minutes to get the person online to same place that the guy in store got to in 2 minutes. "Use find my phone, and turn the lock off". When I asked how I get the passcode off she couldn't answer, and then had to put me through to the AppleCare technical team. I am now awaiting a return phone call.

Much of the conversation revolved around how it was impossible for anyone to remotely add a passcode, unless I did it, or gave them my details. I pointed them to look at this thread and their opinion very quickly changed!

After all this, my one question still remains to be answered:

How can a passcode be added remotely, through iCloud, to a device that did not previously have one, and then Apple not have the method to either remove it, or change it?

How can a passcode be added remotely, through iCloud, to a device that did not previously have one, and then Apple not have the method to either remove it, or change it?

This is a feature of Find My iPhone. You can remotely lock your iPhone with a passcode, as a measure to keep a thief from accessing your data if the phone is stolen. Apple techs cannot clear the code for you because it is an anti-theft feature, and allowing them to unlock it is a very bad idea, because the person who wants it unlocked might be a smooth talker and may know some of your personal information. That's gotten Apple - and other companies - in trouble before:

http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/all/

Tightening of this kind of security at Apple began in direct response to Mat Honan's story.

Same here - in Adelaide. iPad woke me at 4.30am with the message 'Your device has been hacked by Oleg Plis' and sound - I thought it was the morning alarm. I just signed in with my code, and all seems ok. I then signed in to my powerbook - but as a guest user - VERY grateful I did. Message to say I'd been hacked there too, wouldn't let me sign out without erasing all data for that user. As there was nothing but a couple of expendable files on there, I signed out. And the guest user portal has been erased. I then went into my own (password protected) desktop, no hacking message. Have changed my Apple ID password - which has two iPads, two iPhones and my Powerbook attached to it (!!) I've received 15 messages in my hotmail account from Find My Phone to say that 'lost status' was applied to all my devices, 'sounds were played' on all my devices, and all my devices were subsequently 'found'. All devices have passcodes, so I hope this means I've got control back! Have changed my bank password - via phone banking - and will change all my other passwords tomorrow on the desktop at work! Accidentally left my iPhone at work, so was absolutely paranoid that someone had found it and got in... but thanks to this thread, I can see I'm not alone, and iPhone will be sitting on my desk when I get in.. in a couple of hours... Await further instructions and won't be using phone banking on ay of my devices til I'm sure!

Another victim here, FWIW. In Toowoomba, Queensland. Wife's un-passcode protected iPad and iPhone started blaring c.4.45AM, each is locked and displaying the same 'Hacked by Oleg Pliss' message. Her Macbook Air has also displayed the same message as Amberoonie above.

not to mention there's a 3 day lag before the two-step auth. process can be enabled. I've placed a request for an Apple rep to call me this morning re wife's devices. Don't really know what else to do.

I woke up this morning and saw the message too. It had stopped my alarm from going off. That being said I have a passcode and was able to get into my phone.

Just incase, I've gone onto my lap top and changed my Apple ID password and restored my phone to factory settings. I've also downloaded a back-up from a few days back.

I dont know if it'll help but I changed my passcode in aeroplane mode. All seems to be well. I can use my phone ok.

It sounds like the hack is only a problem if you don't have a passcode. But that may be a premature assumption.