I am a US citizen who volunteers for a human rights organization and noticed my iCloud account had a login attempt by someone in Nanchang, China

I'm not sure if I should fear of my personal safety, or be concerned about the confidentiality of my data.

How can I determine if this is legitimate to protect myself?

  • I've edited this to avoid having it closed. Asking multiple related questions in one question is grounds for closing this as too broad. Let's focus on what Apple recommends when they show you this alert. Once that's answered, please consider asking follow on questions if you still have some to ask - just be sure to ask one question per question. – bmike Oct 2 at 3:40
  • Especially now that the question's more focused on the Apple-specific portion of the issue, you might consider asking about the more general security concerns at SE.InformationSecurity. – Nat Oct 2 at 3:47
  • 2
    Let's make that "someone appearing to be in China", if location is really important, which it probably is not. Nothing leaves my home of my 'phone that does not go through a two-hop VPN, so you can't judge anything by apparent location, and that's just with a VPN. – Mawg Oct 2 at 14:28
  • @Mawg should Apple then update its GUI so that I shouldn't take this prompt at literal face value? – TLDR Oct 2 at 19:26
  • 2
    I can't see them doing that, can you? To them, the transaction originated in China, but that might have been from a VPN in China, which someone in - say - New Zealand actually originated. It's just that you had China in the title, as if that made a difference - does it? – Mawg Oct 2 at 20:24

Apple recommends you select Don't Allow since that will block this attempt.

The bottom of the page linked above has steps to take (like change your password) if you think the alert is not correct or a result of your actions.

Next, you should check that the email / alert you see is indeed legitimate (i.e. actually sent by Apple's servers). It is common place to receive emails like this that are actually fake.

In any case, there's no need or obligation for you to report this to Apple or Yahoo. It is not an indication that your or their systems have been hacked.

In case of US State / Federal reporting, unless you're employed by these entities and have specifically been bound to report this (very likely you have not), then there's not need to report it to them either.

  • 3
    If it got to the account ID prompt, which I received, that means my password was compromised, and based on the city of choice, it's the home of China's Liberation Army. Something the US DOD would be interested in – TLDR Oct 1 at 21:51
  • 5
    @Red2 Most hackers use VPNs to disguise their true location. – jkd Oct 1 at 23:22
  • 8
    @Red2 if DOD is interested in you. Too many hacking attempts happening all the time for DOD to care about a Joe Random Volunteer for some human rights org. – muru Oct 2 at 4:16

https://haveibeenpwned.com/

Check your email here to see if your password is anywhere on a publicly leaked database. I recommend you change your password and change it to something unique that isn't used elsewhere.

  • The account is unlisted on that site; which implies a targeted attack of some kind, – TLDR Oct 2 at 2:16
  • 7
    @Red2 Reading this comment and the one under the other answer it seems you think you are being targeted personally by China’s Liberation Army. Unless you are Donald Trump I think that’s rather unlikely. Also note that the accuracy of the location displayed in the alert is very low. haveibeenpwned is a nice resource but doesn’t have all passwords ever leaked (especially more recent leaks might take some time to find their way into their database). – 11684 Oct 2 at 6:19

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.