I was locked out of my Mac. Very scary episode!

[gusanitoverde]

I have one profile for work and another one for personal. On my work profile, I have Microsoft office provided from work, and the usual apps to get me through the work day. At lunchtime, I decided to log off and visit my personal account to run a few errands. I go back to my work account, lo and behold, I cannot get in. I tried everything from removing peripherals, wireless apple keyboard, type the password directly on my laptop (MBP 16" M1) and nothing worked.

100% It was the right password. No typos.

"I got hacked" I thought... So, I tried to reset the password via iCloud. It looked like it was gonna work, and it didn't. He just gave me a warning message that iCloud could not unlock the fire vault.

Then, researching, I found out that I could reboot my M1 MBP and use that boot utilities to recover the password via Terminal. That's how I was able to get in. I was able to change my password.
Here is how: https://www.hellotech.com/guide/for/how-to-reset-admin-password-on-mac

Later, when I open my account, two things happened:
1. All my logins were reset. Everything in Chrome, Safari, MS Office, Evernote, etc.
2. System preferences asked me for my previous password (the one I couldn't open my account with) In order to validate access to keychain, I guess... My old password worked.

Next, I checked Activity Monitor and I couldn't see anything weird and I surveyed the Console app. I couldn't find anything weird either yet I don't know enough to really tell.

What are you guys think that happened?

By the way, I have a Bitdefender AV active. I did a full scan on the Mac, and it shows nothing. I did a scan on both profiles of my Mac.

Should I format? Should I be worried? Has this happened to anyone of you, ever?

Thank you guys!

 

[chabig]

You said you have an M1 MBP. M1 machines can't be broken into from recovery mode because you need to provide the admin password to get there. Did you use your AppleID?

Your old password was your key to your keychain. When you reset the password, you probably lost everything that was in the keychain–including your login credentials for the services you mentioned. I suspect that providing the old password was just to verify identity for iCloud.

 

[gusanitoverde]

I provided the admin password for my personal account. When the Password Recovery Assistant asked me for the old password, it seemed to work just fine. So I reset the password for something else. I am not sure why it worked there, but it didn't work when I tried to access my account previously.

It seems that when I went into my account again, not only passwords were also preferences for programs were also reset to defaults. Very weird.