Hacker group Turkish Crime Family says it’s going to wipe out over 300 million iCloud accounts on April 7th if Apple doesn’t pay US$75,000 as ransom. Apple says the group hasn’t broken into its servers, so that means the logins they claim to have probably came from old hacks into other company’s services.
An Apple spokesperson told Fortune,
There have not been any breaches in any of Apple’s systems including iCloud and Apple ID. The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services.
Many of the logins on Turkish Crime Family’s list look like they may have come from a 2012 LinkedIn data breach where over 100 million accounts were compromised, according to someone claiming to have seen the list. That’s not surprising since criminals trying to extort money out of companies in this way, and hackers trying to get into other services will turn to lists like this.
The TCF is a hacker group claiming they have somewhere between 300 million and 559 million iCloud logins and are demanding Apple give them $75,000 in Bitcoin or Ethereum cryptocurrency, or $100,000 in iTunes gift cards. If Apple doesn’t pay up by April 7th, they say the accounts will all be wiped and the iPhones linked to those accounts will be factory reset.
The ransom amount seems surprisingly low, but Apple still isn’t interested in paying. Apple says it is working with law enforcement to track down the extortionists, and told the group, “We do not reward cyber criminals for breaking the law.”
Assuming the iCloud login credentials came from hacks into other online services, it’s a perfect example of why using the same password on multiple sites is a bad idea. Once hackers have your login for one service they have the information they need to get into others.
If you’re using the same password on multiple sites, now is a good time to change them and start using a password manager, like 1Password, so you don’t forget any of them. If you aren’t using two-factor authentication with your iCloud account, it’s time to set that up, too.
Please use a password manager and don’t reuse passwords people!
Bah. small potatoes. I routinely change passwords and use two-factor authentication. they can do their worst. Whatever. :/