{"id":70858,"date":"2017-03-29T14:29:52","date_gmt":"2017-03-29T21:29:52","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=70858"},"modified":"2025-08-19T09:18:16","modified_gmt":"2025-08-19T16:18:16","slug":"cybercriminals-claim-they-have-millions-of-icloud-credentials","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/cybercriminals-claim-they-have-millions-of-icloud-credentials\/","title":{"rendered":"Cybercriminals Claim They Have ‘Millions’ of iCloud Credentials, but Likelihood Is Low."},"content":{"rendered":"

A lot of people love to play poker for the thrill and entertainment of sheer luck. For some, however, it\u2019s more of a game of skill. One where you can discern the intent of your competitors by reading their faces and tics and betting on whether they have the cards they say they do. It can be fun and challenging for those who reach that level of play. Some cybercriminals, however, are playing poker with Apple, or more specifically, with iCloud. And it appears the company is calling their bluff.<\/p>\n

The Turkish Crime Family, a cybercriminal group claiming it acquired a trove of iCloud<\/a> account details, is demanding Apple surrender the equivalent of $75,000 USD in Bitcoin or $100,000 in iTunes gift by April 7th<\/sup> or they will begin remotely wiping consumer iPhones. This is theoretically possible because iCloud offers its users the ability to remotely wipe devices in the event a device is lost or stolen. Sounds a little scary, but there are a few signs suggesting that this group isn\u2019t as threatening as they\u2019d like to appear. In fact, it appears they\u2019re just making things up as they go along.<\/p>\n

The first clue is that the cybercriminals are inconsistent in the size of their own breach. According to Motherboard<\/a>, which broke the story, the size of the apparent breach ranges from 250 million iCloud and .me accounts to 300 to 550 million. The second clue is the ransom. Depending on which member of the group is talking, the ransom ranges from $75,000 to $700,000 in Bitcoin, both of which are pretty small given the apparent size(s) of the supposed breach.<\/p>\n

Both of these clues are strong indicators that the Turkish Crime Family doesn\u2019t measure up to its own claims. But it doesn\u2019t mean users aren\u2019t at risk. It\u2019s possible these cybercriminals do have access to thousands, if not millions, of Apple accounts. How? It\u2019s simple: they took the stolen account information from other massive breaches<\/a> and applied them to Apple\u2019s iCloud ecosystem. Basically, they\u2019re using other cybercriminal work to extort their own ransom.<\/p>\n

This method, where crooks reuse credentials that\u2019ve already been breached, is known as \u201ccredential-stuffing\u201d attacks. It\u2019s fairly common<\/a> and can be damaging if you constantly reuse the same username and password across different accounts.<\/p>\n

Tips to Lock Down Your Accounts<\/h2>\n

So how can you secure yourself from a credential-stuffing attack? For starters, use unique usernames and passwords (at least eight characters long using both upper and lower-case letters, numbers and symbols) for every account you create. But beyond that, here are a few more tips that will help you lock down your accounts.<\/p>\n