Hacked on Apple Account
Your Apple Account was taken. Here's the next hour.
An Apple Account holds your photos, messages, keychain passwords and Find My. Treat a compromise as total.
Does this look familiar
- Password or trusted phone number changed; you were signed out of iCloud
- Devices you don't own listed in your account
- Two-factor prompts you didn't trigger, repeatedly
- Find My showing your devices somewhere else, or a device removed
- A "your iCloud is full / locked" text or email with a link
Do these, in order
-
Email and carrier first
Before touching Apple Account: from a clean device, change your email password, enable app-based two-factor, sign out of all sessions, and check recovery options. Call your carrier for an account PIN and port-freeze. Full first hour.
-
Reset the password at iforgot.apple.com, ideally from one of your own trusted Apple devices. If you've lost access entirely, start account recovery; it is slow by design and that is a feature.
-
Settings → [your name]: review the device list and remove any you don't own. Check trusted phone numbers and remove additions. Confirm two-factor is on.
-
Settings → [your name] → Sign-In and Security: review Recovery Key, Recovery Contacts and Legacy Contacts for changes. Turn on Stolen Device Protection on iPhone.
-
Review Keychain passwords for accounts the attacker may have reached from here, and change the important ones. Check iCloud Mail rules and forwarding.
-
If devices were remotely locked or wiped by the attacker, contact Apple Support through getsupport.apple.com, never a number from a search result.
Avoid
- Approving two-factor prompts you didn't start. "Prompt bombing" relies on you tapping Allow to make it stop.
- Clicking "iCloud storage" or "Apple Pay suspended" texts.
- Sharing your screen with anyone claiming to be Apple.
After you're back in
Make sure it can't happen the same way twice.
- Figure out how they got in. The fix depends on the door they used, and there's usually more than one.
- Close that door specifically, then the ones next to it.
- Assume the same people will try again. They usually do.
- Check your passwords and email against known breaches with a free account, and run the exposure scorecard. Or let us do the whole thing.