Yesterday, a hacker group known as “Turkish Crime Family” told Motherboard it had obtained access to hundreds of millions iCloud and Apple ID accounts. They’ve threatened to reset passwords and remotely wipe Apple devices of all their data, including photos, videos and messages, unless the company pays a ransom of either $75,000 in the Bitcoin/Ethereum cryptocurrencies or $100,000 in iTunes Gift Cards, by April 7. Today, Apple denied the hacking claims, telling Forbes that iCloud, Apple ID and other systems haven’t been hacked into directly.
“There have not been any breaches in any of Apple’s systems including iCloud and Apple ID,” an Apple spokesperson told the publication. As it turns out, “Turkish Crime Family” has most likely obtained a cache of stolen email accounts and passwords.
“The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services,” Apple commented. A person familiar with the contents of the alleged data set told Forbes that many of the email accounts and passwords matched data leaked in a past breach at LinkedIn.
The LinkedIn hack exposed passwords of more than a hundred million users. Hundreds of millions of passwords belonging to Yahoo and Dropbox accounts were also leaked.
Subscribe to iDownloadBlog on YouTube
“Turkish Crime Family” originally said it held 300 million iCloud accounts for ransom, but soon after corrected themselves and said they had in their possession login credentials for as many as 559 million Apple email and iCloud accounts.
“I just want my money and thought this would be an interesting report that a lot of Apple customers would be interested in reading and hearing,” an unnamed member of the hacker group told Motherboard.
“It’s not uncommon for hackers to use journalists as megaphones to bring attention to their claims, even when their threats are empty,” cautioned Forbes.
The usual caveats apply: don’t use the same password across online services, change your passwords on a regular basis and use password managers to secure all your passwords. If you have the same password for your Apple ID and LinkedIn, you may be in danger as hackers would attempt to reuse your compromised LinkedIn password to break into your Apple ID.
Be sure to use Apple’s Two-Factor Authentication as an additional layer of security for your Apple ID/iCloud account.
Apple told Forbes that it is “actively monitoring” to prevent unauthorized access to user accounts. Such measures are “standard procedure,” added the firm.
“We are working with law enforcement to identify the criminals involved,” said the Cupertino firm. “To protect against these type of attacks, we always recommend that users always use strong passwords, not use those same passwords across sites and turn on two-factor authentication.”
Source: Forbes