Hacked on Apple Account

Your Apple Account was taken. Here's the next hour.

An Apple Account holds your photos, messages, keychain passwords and Find My. Treat a compromise as total.

Does this look familiar

  • Password or trusted phone number changed; you were signed out of iCloud
  • Devices you don't own listed in your account
  • Two-factor prompts you didn't trigger, repeatedly
  • Find My showing your devices somewhere else, or a device removed
  • A "your iCloud is full / locked" text or email with a link

Do these, in order

  1. Email and carrier first

    Before touching Apple Account: from a clean device, change your email password, enable app-based two-factor, sign out of all sessions, and check recovery options. Call your carrier for an account PIN and port-freeze. Full first hour.

  2. Reset the password at iforgot.apple.com, ideally from one of your own trusted Apple devices. If you've lost access entirely, start account recovery; it is slow by design and that is a feature.

  3. Settings → [your name]: review the device list and remove any you don't own. Check trusted phone numbers and remove additions. Confirm two-factor is on.

  4. Settings → [your name] → Sign-In and Security: review Recovery Key, Recovery Contacts and Legacy Contacts for changes. Turn on Stolen Device Protection on iPhone.

  5. Review Keychain passwords for accounts the attacker may have reached from here, and change the important ones. Check iCloud Mail rules and forwarding.

  6. If devices were remotely locked or wiped by the attacker, contact Apple Support through getsupport.apple.com, never a number from a search result.

Avoid

  • Approving two-factor prompts you didn't start. "Prompt bombing" relies on you tapping Allow to make it stop.
  • Clicking "iCloud storage" or "Apple Pay suspended" texts.
  • Sharing your screen with anyone claiming to be Apple.

After you're back in

Make sure it can't happen the same way twice.

  • Figure out how they got in. The fix depends on the door they used, and there's usually more than one.
  • Close that door specifically, then the ones next to it.
  • Assume the same people will try again. They usually do.
  • Check your passwords and email against known breaches with a free account, and run the exposure scorecard. Or let us do the whole thing.