Paul Morris·

You Should Probably Secure Your iCloud Account Now, Here’s Why

If you hear news that a group of hackers are in possession of hundreds of millions of iCloud accounts which have been acquired through the obvious less-than-honorable means, then the chances are that the issue isn’t going to just disappear overnight.

After initially going public to suggest that it was holding near enough 600 million iCloud account credentials, the London-based hacker group calling itself the Turkish Crime Family initially tried to extort up to $100,000 out of Apple in exchange for the deletion of the account data.

Apple strongly denied that a breach had occurred, and still stands by that, but it looks as though at least a percentage of the stolen accounts hold valid email and password combinations.

After demanding Apple Inc. pay a ransom totaling $75,000 in either Bitcoin or Ethereum or $100,000 in iTunes Gift Cards by April 7, the group also suggested that it would start remotely wiping iOS devices of all of their data on that same date if the monetary amount wasn’t paid.

Apple has since released a public statement to confirm that its servers haven’t been breached, and that no data had been compromised, but ZDNet has been able to confirm that at least a very small subset of the overall dataset is genuine and does provide access to demoed iCloud accounts.

The issue has understandably piqued the interest of a lot of different media outlets, with some taking the opportunity to dig a little deeper to try and ascertain exactly what has been going on. Members of the Turkish Crime Family provided the outlet with 54 individual records from the larger list. Armed with those accounts, it has now been confirmed that the information is accurate and representative of real account information, which is, of course, a huge concern for device owners and Apple.

What’s particularly interesting here is that most of those confirmed accounts have been using the same password since they originally set up the iCloud account many years ago, which could suggest that the data has been obtained from a previous breach on a third-party service.

It seems very likely that the group behind the attempted extortion is extremely inexperienced in this type of cyber crime, and is looking to garner attention to fuel its “cause”. However, even if the account data is extremely old, and you regularly change your password, it’s still a very good and sensible idea to not only change the password now, but to also set-up two-factor authentication on the account to prohibit any access from unauthorized sources.

We have previously covered a guide on exactly how to to that here: Enable Two-Factor Authentication On Apple ID / iCloud, Here’s How. While it is recommended that you stick to the 2FA method, but if not, you can at least enable two-step-verification by following our guide here: How To Enable Two-Step Verification For Apple ID / iTunes / iCloud.

You might also like to check out:

You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the Web.