Have I been hacked? Passcode lock

[mvigeant]

My son has a 2011 Macbook Air. It was working fine on Friday morning.
On Saturday morning, it had gone to a grey screen requesting a passcode, with four white boxes, of the type you would see if the machine had been put into Lost Mode. However, I didn't put it in lost mode (in fact, I didn't have "find my Mac" turned on for it at all). We are not aware of having set a passcode on this machine ever, and it's not responding to any of the codes we were likely to have used (for example, the code for the parental restrictions).
We did buy this machine used, and while I thought everything was wiped when we bought it, maybe somehow the previous owner did this (but it seems unlikely, we've had it for over six months, and I would have noticed if there was another iCloud account active). I have high confidence that the previous owner was, in fact, the original owner and not selling shady goods to 10 year olds. This leads me to think it's actually been hacked. Is this something that is happening? And are there any good ways out of our problem?

 

[chabig]

I would bet money you haven't been hacked...how would anyone have done that?

Lesson learned--when you buy a new machine, you should wipe the drive and reinstall the OS from scratch so you know that it's in a good state.

Now that you're here, let's think about solutions. 1) contact the previous owner and ask them if they put it into lost mode? If so, ask them to take it off. 2) if you're near an Apple store, you could make a Genius Bar appointment. 3) you might need to reboot to the recovery partition and reinstall the OS, then restore from your backup.

 

[Shirasaki]

It is likely original owners forgot to attempt a hardware system reset, including removing their machine from find iPhone list (Apple says this on all places, including Mac, iPhone and iPad). Reinstalling system would not help much of such thing.
I don't think installing system from scratch would help. I would even think you may not be able to boot to recovery or even Internet recovery due to this lost mode, although I didn't have a try to see what would happen in this state.
Apple Genius Bar may be a good place to get some official explanations.
Your best bet is contacting original owner and ask them what was happening on this machine.

 

[rigormortis]

if you see a grey screen with a passcode lock on a macintosh computer it means someone has logged onto iCloud and locked your computer. or someone had physical access to your computer and enabled a firmware password.

the reason why the hard disk wasn't erased was because it was intended as a prank

change your iCloud password, and enable 2 step authentication

tell the original owner ( if any ) to remove his computer from iCloud

 

[chabig]

Also, when you buy a used Mac you should turn on Find my Mac with your own AppleID. I don't think you can if the computer is still associated with another AppleID.