Waking up to the smell of coffee and bacon is a great way to start your day. Waking up to a lost iPhone message and ransom note for $100 isn’t. On Tuesday several Apple device owners in Australia were rudely awoken by the news that their iPhone, iPad, or Mac had been hacked.
The hacker’s victims received lost iPhone alerts on their devices, which were then followed by a demand for money. Ransom amounts ranged from $50 to $100 and owners were told to send the money via PayPal. A few users were able to unlock their devices if they had a passcode set up, but most were completely locked out of their iPhones, iPads, and Macs. A few unfortunate souls even lost access to multiple devices at the same time.
Apple’s support forums and Twitter exploded with upset iDevice owners, looking for a quick fix.
“I was using my iPad a short while ago, when suddenly it locked itself…” one bewildered user wrote on Apple’s support page. “I went to check my phone and there was a message on the screen (it’s still there) saying that my device(s) had been hacked by ‘Oleg Pliss’ and he/she/they demanded $100 USD/EUR (sent by PayPal).”
It is highly unlikely that the hacker used his real name and one Oleg Pliss, who is employed by Oracle, is certainly not the culprit. The true name of the hacker and his whereabouts are currently unknown.
“I have the same problem, with the exact same message,” another user wrote. “Affecting both my iPhone and iPad. Have reset passwords on all my applications (banking, email, social media etc) just in case.”
So far, all of the incidents that have been reported occurred in Australia. It is unknown how the hacker managed to gain access to so many Apple IDs, but it’s possible that a database breach is to blame. Many users reuse passwords and email addresses for multiple accounts, putting themselves at risk for such an attack. Affected iOS and Mac users are encouraged to contact Apple or their cellular carrier to address the issue.
Update by Malarie on 5-28-2014: This post has been updated to reflect statements from Apple and PayPal regarding the hack.
Apple responded a day and a half after the hack occurred, telling users that iCloud is not to blame for the breach.
“Apple takes security very seriously and iCloud was not compromised during this incident,” Apple said in a statement. “Impacted users should change their Apple ID password as soon as possible and avoid using the same user name and password for multiple services. Any users who need additional help can contact AppleCare or visit their local Apple Retail Store.”
Apple did not say how many users were affected by the hack, nor did it identify the cause. Although some users have regained access to their iDevices, many are still locked out.
PayPal also issued a statement, telling its customers that the hotmail address given by the hacker was not associated with any PayPal account. The company assured those affected by the hack that even if money had been sent to the hacker, PayPal’s users would be protected by the company’s Buyer Protection policy. Additionally, the online payment service promised that any customer account details saved in the PayPal app on users’ iDevices will remain safe from the hacker.
