Long story short, a close friend had their iPhone stolen a few months ago. Just yesterday they got a text saying their phone was found with a link claiming to show the phone's location. Unfortunately, this person fell for the phish and ended up submitting their iCloud credentials. I assume that the thieves now have the ability to reset the phone.
The main worry here though, is whether the thieves are able to decrypt the contents of the phone? Is it possible for them to extract the data from the phone knowing the iCloud password?
EDIT: Also, is there any valid fear that they can extract the data directly from storage by connecting a USB cable to the phone or use any 3rd party apps to do this?