Nothing unusual about that:This story from Apple does not smell right.
They say they noticed it, nothing was taken and reported to the police.
That story would stand up, were it not for the fact that he'd been doing it for a year or more.
So they did not notice it for a year or what ?
"The study found that US companies took an average of 206 days to detect a data breach."
https://www.itgovernanceusa.com/blog/how-long-does-it-take-to-detect-a-cyber-attack/