Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

iCloud hacked and account deleted

Hi everyone,


So last night while I was out and my iPhone kept asking me to enter my iCloud password and I kept ignoring it because I was busy.


This morning I realised that my iPhone, iPad and MAC book were all asking me to enter my ID and password and then were telling me my password was incorrect.


I went online to the iFind thing and it told me that the birth date I was putting in did not match my iCloud ID.


I went to try and sign up for a new iCloud account with the ID that has been hacked and it told me the email IS available. Which would mean that my account has been deleted or someone has changed the primary email address?


Am I correct in thinking this? I am just worried about my credit card details, I can't remember if they were current but they had been stored on there from what I recall.


I was also sent an email last night twice to my primary email address telling me that there had been changes to my account it said:


The following changes to your Apple ID were made on DATE and TIME.


Apple ID
Email address(es)


Then it says if you need additional help go to this link. What I think is ridiculous is that I can't contact Apple on a Sunday and there is no link to anything saying "If you did not make these changes click here".


Also my other question is if I make a new iCloud ID and set all my devices up with it will I lose everything?


Thanks,


Melkeh.

Posted on Jul 12, 2014 6:36 PM

Reply
15 replies

Jul 13, 2014 4:49 AM in response to randers4

Thanks for your help!


The password and email address have both been changed, my iPhone keeps prompting me to enter my password but then says it's incorrect.


I've set up a new iCloud account but because I have Find my phone activated and can't remember my password I can't turn it off and sign into my new account.


Am I going to have to reset the entire phone? I'm on IOS 7.1.2.

Jul 12, 2014 6:49 PM in response to melkeh

You'll need to contact the Apple account security team for your country: Apple ID: Contacting Apple for help with Apple ID account security.


On your last question, you could migrate your data to a new account set up with a new ID, but if you are running iOS 7 with Find My iPhone enabled, you're going to need the password to delete the existing account. If you did have the password, you would start by saving any photo stream photos that you want to keep to your camera roll (unless already there) by opening your my photo stream album, tapping Select, tapping the photos, tap the share icon (box with upward facing arrow), then tapping Save to Camera Roll. If you are syncing notes with iCloud that you want to keep, you'll need to open each of your notes and email them to yourself so you can later copy and paste the text into new notes created in your new account. Then go to Settings>iCloud, tap Delete Account, provide the password to turn off Find My iDevice and choose Keep on My iDevice when prompted. Then sign back in with a different Apple ID to create your new account and choose Merge to upload your data.

Jul 13, 2014 5:50 AM in response to melkeh

Someone has hacked your Apple ID/iCloud account, and they are trying to prevent you from regaining access. You need to contact Apple immediately, according to the link randers4 gave you. If you delay, it's possible they could make it impossible for you to ever regain access to your Apple ID.


There are two problems with this. First, since your phone is running iOS 7 and has Find My iPhone turned on, you will not be able to reset your phone without knowing the Apple ID password. The hacker could remotely lock your phone, remotely erase it or even look up your physical location, and without that password, you cannot stop him. Further, if he manages to lock you out of your Apple ID permanently, you will also be locked out of your iPhone permanently. There will be no way to erase the phone and get it working again.


Second, all the purchases you have made using your Apple ID are tied to that Apple ID. If you lose access to that Apple ID, you lose all those purchases as well.


If the hacker manages to enable two-factor authentication on your Apple ID, that will effectively lock you out of your Apple ID permanently. Once enabled, Apple will not, and cannot, do anything to help you regain access. There is a three day "waiting period" for enabling two-factor authentication, giving you a short period of time in which to contact Apple and regain access to your Apple ID. You MUST act within that period of time. There is normally an e-mail sent when a request is made to enable two-factor authentication, but if the hacker has changed all the e-mail addresses on your Apple ID, you would no longer receive that e-mail.


In short - get on the phone to Apple, and do it fast before you lose your chance, and thus lose your Apple ID, your phone and all your purchased apps/music/movies/etc!

Jul 13, 2014 6:10 AM in response to melkeh

melkeh wrote:


But my iCloud is trying to log in to my original Apple ID.


I don't know what that means. Your Apple ID and your iCloud account are the same thing, so one can't log in to the other.


And it's telling me it can't so doesn't this mean that my iPhone isn't connected to any iCloud account at all right now?


It sounds more like your phone is trying to connect to your Apple ID/iCloud account and can't, because the hacker has changed the password.


You really need to contact Apple ASAP! You seem reluctant to do so... why?

Oct 29, 2014 7:01 PM in response to melkeh

This happened to me today while I was on the computer. I wrestled with the culprit, resetting and re-resetting my apple id.


I believe they used the email plus birthdate and specially coded url to do the hack.


I have removed my original apple id and replaced with new email and I'm changing my birthdate in profile


I also went to Facebook and hid all that information.


Apple Support was really helpful ..... this is twice within a week. I'm being targeted for some reason.

Oct 30, 2014 2:59 AM in response to Allan Gengler

If you haven't done so already, secure it by enabling two-factor verification now:


http://support.apple.com/kb/ht5570


Also, note that it's not a trivial thing to replace one Apple ID with another. All your purchases on one Apple ID are tied permanently to that Apple ID. You really don't want to start using two if you can help it. Secure the one you've been using and keep using it.

Oct 30, 2014 6:52 AM in response to thomas_r.

Yes, but that's not an automatic process. It actually takes two days.


In the meantime I change my birthdate on my profile, removed my old email address and added a new one as primary. Luckily that doesn't seem to affect anything I've bought before


I recommend someone getting a gmail account and keeping it private for your apple id. You can replace your former primary with a new one and it doesn't affect your account. All your purchases remain.


It would be a bad thing to create a NEW apple id. You lose all your purchases and history.

Oct 30, 2014 7:24 AM in response to Allan Gengler

Allan Gengler wrote:


Yes, but that's not an automatic process. It actually takes two days.


That doesn't make it any less important to do. And it doesn't always take that long... I don't understand the pattern (or the reasoning), but in some cases it can be turned on immediately, and in others there is a required waiting period.


In the meantime I change my birthdate on my profile, removed my old email address and added a new one as primary.


Changing your birthdate is less important than changing your security questions. Those will be removed entirely after two-factor verification is enabled, but for the time being, they should be changed to something completely unpredictable. (Random text works best, but be sure to save that text somewhere safe.)


Also, note that changing the e-mail address on your Apple ID does nothing to secure it, unless the old e-mail address itself has been hacked, in which case it's best to address that issue rather than ignoring it.

Oct 30, 2014 7:52 AM in response to thomas_r.

While what you say is true. It's untrue about the birthdate and email address


If someone knows your email that you use for your apple id and your birthdate, the hack of using those and a specifically formed URL seems to be still in effect.


If you remove the known email and create a random birth date then that hack goes away.


The hack actually allows someone to skip the questions and change the primary email address and password willy nilly.


I feel I was targeted, but I'm not sure why.


And the two step verification, for security reasons, takes 48 hours.

Oct 30, 2014 8:18 AM in response to Allan Gengler

Allan Gengler wrote:


The hack actually allows someone to skip the questions and change the primary email address and password willy nilly.


That issue was fixed in March of 2013. It no longer exists. If it did, you can bet that it would be MAJOR news in the computing security world!


And the two step verification, for security reasons, takes 48 hours.


As I said, not in all cases. It certainly may take that long, but I have personally set it up - very recently - on an account without having to wait at all. There is no pattern I can discern, but some accounts are required to wait while others aren't.

Oct 30, 2014 8:25 AM in response to thomas_r.

Yes I've read that. I'm not sure it's true. Just because they say a hack has been fixed is not true forever. Another iteration may exist and the news don't know about it yet. It's either that or social engineering.


If my main email was hacked by brute force, not at apple, I've removed it and changed my password. It would be hard to brute force apple, but I guess not impossible. If that were tried I would have been getting many emails about the attempt.


I also created a new rescue email that I'm not sharing with anyone.

iCloud hacked and account deleted

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.