Apple ID password compromised - what now?

[Droooooj]

A family member had their Apple ID compromised for a couple of hours by completing a 'reset password request' in an email phishing scam.

They've since gone to Apple and successfully reset the password.

I'm wondering what else to look out for now, or if any other action needs taking?

Their Apple ID username was a non Apple email address, so I've advised them to also change the password for their email, and to any other online account that uses that email as the login.

Anything else??

 

[Apple_Robert]

Moving forward...

In my opinion, it would be a good idea to enable two-factor authentication on email accounts (where possible). Also, where security questions are part of the equation, make sure the answers are very obscure that only the owner of the account would know. I would also encourage your family member to use a password program like 1Password, so that he or she can keep up with and monitor having a different password for each and every online account.

 

[tomnavratil]

Nowadays, two-step verification where possible is a must, especially for accounts, which have any sensitive information in them. I hope the person did not use the same password elsewhere, that is a very common mistake as well. As @BasicGreatGuy has said using a password manager like 1Password or LastPass is definitely a good idea.

 

[Droooooj]

Thanks guys, I get what you mean about 2 step verification, but I read that Apple won't ever recover that sort of account if ever the password is lost, so in this case (knowing my family!) I would say it was unwise.

So far the only fall out from the original incident is an email from Instagram saying the account has been locked due to suspicious activity, but that should be sortable.

I was wondering what sort of contact details the hacker might've been able to gain and what to look out for? There's an iPhone, Macbook and iPad linked to the Apple ID.

 

[tomnavratil]

Thanks guys, I get what you mean about 2 step verification, but I read that Apple won't ever recover that sort of account if ever the password is lost, so in this case (knowing my family!) I would say it was unwise.

So far the only fall out from the original incident is an email from Instagram saying the account has been locked due to suspicious activity, but that should be sortable.

I was wondering what sort of contact details the hacker might've been able to gain and what to look out for? There's an iPhone, Macbook and iPad linked to the Apple ID.

That's correct, it's definitely much more difficult to recover that sort of account. When you are presented with a recovery code, it's good to have a few copies of it in the safe places - family / bank etc.

I would suggest to change ALL the passwords where that certain password has been used. Yes, it's a pain but it gives you a piece of mind. I've been using one password pattern for all my sites and then one of them got hacked, a few of my accounts compromised but I've been able to act fairly quickly. Not a great feeling.

Apple ID includes a lot of personal information and a lot of information about the devices as well. Name / addresses / emails / telephone numbers etc. Don't also forget that information can be used to login to iCloud.com to access more settings, lock and erase linked devices as well through iCloud's interface.

 

[ardchoille50]

Moving forward...

In my opinion, it would be a good idea to enable two-factor authentication on email accounts (where possible).

This is not just a good idea, it is vital, in my opinion. With two-factor authentication, a person can't even log into an Apple ID account without that second step of authentication. Two-factor authentication makes those phishing scams a waste of time for the attacker.