# Widespread Hacking of Apple Itunes/AppStore Accounts **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [July 5, 2010, 12:54am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572 "2010-07-05T00:54:21Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Wordy](https://avatars.discourse-cdn.com/v4/letter/w/4491bb/32.png) [@Wordy](https://boards.straightdope.com/u/Wordy)\ **Post date:** [July 5, 2010, 12:54am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/1 "2010-07-05T00:54:21Z")
Better take your credit card information off Itunes/AppStore people, it’s been massively hacked and there are cumulating reports of people complaining and reporting stolen money. Apple “security” is non-existent. The hackers are robbing people of money through the credit cards/debit cards/bank accounts linked to your Itunes/AppStore account: > **[App Store, Hacked. (Updated: iTunes Accounts too.)](https://thenextweb.com/news/app-store-hacked)** > > Editors Note: This article began with details of one specific app developer hacking iTunes users accounts and purchasing their own apps using those accounts – making it to the top of the iTunes charts. As the story has developed it appears > [@](#): > > This article began with details of one specific app developer hacking iTunes users accounts and purchasing their own apps using those accounts – making it to the top of the iTunes charts. As the story has developed it appears to be far more widespread than just that one particular developer and his apps. We’ve received a number of reports of accounts being hacked and used to make purchases on iTunes. And from one of the Apple fanboi forums: > **[I think my iTunes account was hacked?](https://forums.macrumors.com/threads/i-think-my-itunes-account-was-hacked.407990/)** > > Earlier tonight i was trying to connect my sisters account and mine (to add an allowance). I signed in to my iTunes account and it immediately said in a pop up that my information had been recently changed. I clicked ok and it took me to the... > [@](#): > > On Friday there was $1400 missing from my checking account. I checked with my bank and it was ALL from unathorized itunes purchases. There are currently 4 computers authorized on my account; I only authorized 1: the one I’m using now. The deauthorize all computers button that is supposed to be on my account page is NOT THERE. I notifed Apple on Friday when there wire still over 1200 pending downloads. THEY DID NOTHING except tell me they don’t do refunds. They didn’t even stop the illegal downloads. As we speak, someone is downloading songs from my account (there are 300 left) and I can’t do anything about. I changed my password and personal info several times. I did not receive ANY email receipts for itunes credit card transactions. In addition, there are FURTHER pending charges on my account that were racked up after I cancelled my credit card. I WILL NEVER PAY!!! Many more where those quotes come from. Steve Jobs’ Jesus powers are not a replacement for good security. And all Apple’s “security” is Steve Jobs’ halo. And I bet you that Apple and Steve Jobs are going to deny everything and deflect all the blame onto the customer for being stupid like with the shitty reception on their iPhone4. ---
**Author:** ![Chimera](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Chimera](https://boards.straightdope.com/u/Chimera)\ **Post date:** [July 5, 2010, 1:17am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/2 "2010-07-05T01:17:22Z")
Not entirely correct. If you report the transaction as fraudulent _to your credit card_, it will not be paid. Apple will cooperate the them to investigate it. They can also disable the account so that it cannot be used until it all gets sorted out. It is Credit Fraud, so you report it to your credit card company and it is handled from there. Just like if your credit card is used with [Amazon.com](http://Amazon.com) or at Walmart. ---
**Author:** ![Wordy](https://avatars.discourse-cdn.com/v4/letter/w/4491bb/32.png) [@Wordy](https://boards.straightdope.com/u/Wordy)\ **Post date:** [July 5, 2010, 1:22am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/3 "2010-07-05T01:22:02Z")
> [@Chimera](#): > > Not entirely correct. If you report the transaction as fraudulent _to your credit card_, it will not be paid. Apple will cooperate the them to investigate it. They can also disable the account so that it cannot be used until it all gets sorted out. > > It is Credit Fraud, so you report it to your credit card company and it is handled from there. Just like if your credit card is used with [Amazon.com](http://Amazon.com) or at Walmart. That’s not going to help the Apple fanboi I quoted who linked his Itunes account to his chequing account and lost “$1400” or those who linked debit cards. And you will still be out at least $50 minimum through your credit card because you are legally obligated. ---
**Author:** ![minor7flat5](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/minor7flat5/32/258_2.png) [@minor7flat5](https://boards.straightdope.com/u/minor7flat5)\ **Post date:** [July 5, 2010, 1:45am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/4 "2010-07-05T01:45:17Z")
Thanks for the info. I will look at my iTunes account to see if there is any unexpected activity. That first link was quite informative, and it is probably high time I changed that password. Your tone is a little alarmist and not helped by the fact that the second example given was posted February 3, 2008. ---
**Author:** ![Wordy](https://avatars.discourse-cdn.com/v4/letter/w/4491bb/32.png) [@Wordy](https://boards.straightdope.com/u/Wordy)\ **Post date:** [July 5, 2010, 1:50am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/5 "2010-07-05T01:50:33Z")
> [@minor7flat5](#): > > Thanks for the info. I will look at my iTunes account to see if there is any unexpected activity. That first link was quite informative, and it is probably high time I changed that password. > > Your tone is a little alarmist and not helped by the fact that the second example given was posted February 3, 2008. Check the other pages of that thread for more recent posts about stolen money from iTunes accounts. It goes from 2008 to the present. Here’s one from today: > **[I think my iTunes account was hacked?](https://forums.macrumors.com/threads/i-think-my-itunes-account-was-hacked.407990/)** > > Earlier tonight i was trying to connect my sisters account and mine (to add an allowance). I signed in to my iTunes account and it immediately said in a pop up that my information had been recently changed. I clicked ok and it took me to the... > [@](#): > > I also received a receipt via email on my “Purchases” on 7/2/10. I made the mistake of storing my debit card on the itunes store app. I have run into the exact same responses that other users are reporting–only email as a method of contact. > > That response was to tell me how to change passwords, etc. - stock answers and to also tell me of no refunds. I was an internet technician for years so the iTunes advise was second nature for me but with little hope for “fixing” the issue since I believe that the breach was on the iTunes server. > > Thankfully, I carry a smartphone with my email setup on it, so I received the invoice quickly. Most of the 15 purchases where for items that I don’t even own i.e. iphone (I have a blackberry) and ipod (I’m 47 and I still use a radio for my music). I was able to verify the $70.15 charge via mobile banking and immediately called my bank. The transaction was in the processing stage and I think my bank was able to refuse it–I’ll see after the holiday weekend. With my card canceled, the additional $20+ charge was unable to be authorized. > > I noticed reading the comments that someone was starting a class action suit, there are enough victims to be able to make iTunes responsible for this. > > I will not take this laying down–I’ve filed a police report and filed a complaint with the Better Business Bureau and if I can afford it–I want to be included in the class action suit if it was started. I am currently trying to figure out how to get the news media notified of this scam. > > Good luck to everyone on getting justice for this crime. And you should be very alarmed because in many cases, you will not get your money back. ---
**Author:** ![aruvqan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aruvqan/32/2891_2.png) [@aruvqan](https://boards.straightdope.com/u/aruvqan)\ **Post date:** [July 5, 2010, 3:05am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/6 "2010-07-05T03:05:03Z")
I guess i am safe, not only did I never register a card with them, last activity on my account was back in early 2009 … other than some free podcasts I get from PBS. I like the ability to buy music as a download, but I like the oddball stuff and emusic is a better fit for me. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [July 5, 2010, 3:15am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/7 "2010-07-05T03:15:50Z")
Heh, turns out my account - which I always keep logged in - didn’t have my debit card’s 3-digit number (from the back) entered. Good luck with that! ---
**Author:** ![Chimera](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Chimera](https://boards.straightdope.com/u/Chimera)\ **Post date:** [July 5, 2010, 3:45am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/8 "2010-07-05T03:45:30Z")
I dunno, I spoke to an acquaintance the other day who was complaining that he saw a purchase from the iTunes store on his credit card and he didn’t even have an iTunes store account. If so, it would appear that they didn’t get his CC information from hacking Apple, but rather got it from someplace else and used it on an Apple site. The way I figure it, when you consider such things, if you use a stolen CC at a site where you download shit and aren’t having it mailed to you, you’re not giving them an address where they can come looking for you. Of course, these days they can check out IP addresses and all that shit, but it still makes it a lot more difficult to find you. I don’t have an iTunes store account either, although I have considered it and other options. I guess I already have roughly 5,000 songs on my computer, I’m a bit older, and I’ve worked with computers for 30 years and have experienced data loss, so I very much like having hard copies of things I buy. ---
**Author:** ![Wordy](https://avatars.discourse-cdn.com/v4/letter/w/4491bb/32.png) [@Wordy](https://boards.straightdope.com/u/Wordy)\ **Post date:** [July 5, 2010, 4:09am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/9 "2010-07-05T04:09:46Z")
> [@Chimera](#): > > I dunno, I spoke to an acquaintance the other day who was complaining that he saw a purchase from the iTunes store on his credit card and he didn’t even have an iTunes store account. If so, it would appear that they didn’t get his CC information from hacking Apple, but rather got it from someplace else and used it on an Apple site. The way I figure it, when you consider such things, if you use a stolen CC at a site where you download shit and aren’t having it mailed to you, you’re not giving them an address where they can come looking for you. Of course, these days they can check out IP addresses and all that shit, but it still makes it a lot more difficult to find you. > > I don’t have an iTunes store account either, although I have considered it and other options. I guess I already have roughly 5,000 songs on my computer, I’m a bit older, and I’ve worked with computers for 30 years and have experienced data loss, so I very much like having hard copies of things I buy. Not so with these hackings of iTunes accounts. If you read the various news postings and Apple fanboy forums, you will see that many of them can see what was purchased by someone else using their account. It’s not just credit card numbers, but also debit cards and bank accounts that are linked to iTunes. And if you read the postings, you will notice that it is all centred around stolen money through iTunes. The victims are not seeing purchases/stolen money going through any other place. If I had your credit card number and not just hacked an iTunes account, why in the world would I go buy useless apps from Apple instead of taking an easier route and buy something more useful or steal the money outright? ---
**Author:** ![cckerberos](https://avatars.discourse-cdn.com/v4/letter/c/f0a364/32.png) [@cckerberos](https://boards.straightdope.com/u/cckerberos)\ **Post date:** [July 5, 2010, 9:02am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/10 "2010-07-05T09:02:11Z")
This happened to me. I woke up this morning to find roughly $150 in charges had been made by someone in China (I found out when the e-mails came). My account password hadn’t been changed, so I went into iTunes and changed it and removed my credit card information. I’m not sure how the hacker got my information; I run updated, redundant anti-virus and spyware software on my PC. My iPhone is jailbroken which is the most likely culprit, though I’ve been careful about what I install. A little surprising is that rather than the Japanese account that I used 3 days ago the account that was used was the American account that I haven’t used for a few weeks. I don’t blame Apple (unless the breach was on their end, of course), but it would have been nice if the strange account behavior (I’ve bought about 4 paid apps in the past 8 months and the thief grabbed 50 or so in 12 hours). Anyway, I submitted a support claim to Apple (though I don’t expect anything to come from that) and will dispute the charges through my credit card company once they go through. ---
**Author:** ![interface2x](https://avatars.discourse-cdn.com/v4/letter/i/c0e974/32.png) [@interface2x](https://boards.straightdope.com/u/interface2x)\ **Post date:** [July 5, 2010, 3:45pm UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/11 "2010-07-05T15:45:08Z")
> [@Wordy](#): > > That’s not going to help the Apple fanboi I quoted who linked his Itunes account to his chequing account and lost “$1400” or those who linked debit cards. And you will still be out at least $50 minimum through your credit card because you are legally obligated. At least for my debit card, I’d still be able to recover all funds. In the summer of 2008, I found that someone had cloned my debit card and spent over $2K one night. I told my bank and they said that all I had to do was detail the fraudulent transactions listed on my account, sign it, and fax it to their headquarters, which I did from a local branch. One week later, every dime was returned to my account and they even re-figured an interest statement to include the stolen funds. The most inconvenient aspect was being without my debit card for a couple of weeks while they replaced mine with a new one. ---
**Author:** ![Wile\_E](https://avatars.discourse-cdn.com/v4/letter/w/c37758/32.png) [@Wile\_E](https://boards.straightdope.com/u/Wile_E)\ **Post date:** [July 6, 2010, 11:22pm UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/12 "2010-07-06T23:22:21Z")
Okay, I removed my credit card info from my account. I was thinking of buying an itunes gift card for $10 to $15 and using that for my account since I rarely ever purchase anything but this way I’d have a way to pay for it. Will that be safe? Do gift cards expire? ---
**Author:** ![WolfpackJeep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolfpackjeep/32/2921_2.png) [@WolfpackJeep](https://boards.straightdope.com/u/WolfpackJeep)\ **Post date:** [July 7, 2010, 12:29am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/13 "2010-07-07T00:29:36Z")
> [@Ferret\_Herder](#): > > Heh, turns out my account - which I always keep logged in - didn’t have my debit card’s 3-digit number (from the back) entered. Good luck with that! Not only was my credit card’s 3-digit number missing…the card I had on file had expired. ---
**Author:** ![spoike](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@spoike](https://boards.straightdope.com/u/spoike)\ **Post date:** [July 7, 2010, 12:45am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/14 "2010-07-07T00:45:42Z")
My iTunes account was hacked three months ago. AmEx called because I’m not in the habit of purchasing all sorts of Avatar-based crap, so it was flagged as unusual activity. The credit card was cancelled, iTunes was informed, and I quickly changed my iTunes password. I didn’t bother changing the credit card info as I was in a hurry. Two weeks ago, I got an email receipt from iTunes. The jackass thief had downloaded more stuff, which meant he’d figured out the new password, and that iTunes had allowed charges on a cancelled credit card. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [July 7, 2010, 12:56am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/15 "2010-07-07T00:56:06Z")
> [@Wile\_E](#): > > Okay, I removed my credit card info from my account. Any tips on that? I tried to delete everything and it didn’t appear to want to let me. ---
**Author:** ![Marathon](https://avatars.discourse-cdn.com/v4/letter/m/7cd45c/32.png) [@Marathon](https://boards.straightdope.com/u/Marathon)\ **Post date:** [July 7, 2010, 1:15am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/16 "2010-07-07T01:15:12Z")
> [@Ferret\_Herder](#): > > Any tips on that? I tried to delete everything and it didn’t appear to want to let me. In your Account screen, once you choose “Edit Payment Information,” you get a set of icons of types of cards (Visa, MC, etc). At the end is a radio button for “None.” It’s somewhat easy to miss; I did at first. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [July 7, 2010, 1:48am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/17 "2010-07-07T01:48:46Z")
> [@Marathon](#): > > In your Account screen, once you choose “Edit Payment Information,” you get a set of icons of types of cards (Visa, MC, etc). At the end is a radio button for “None.” It’s somewhat easy to miss; I did at first. Excellent, thanks. ---
**Author:** ![minor7flat5](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/minor7flat5/32/258_2.png) [@minor7flat5](https://boards.straightdope.com/u/minor7flat5)\ **Post date:** [July 7, 2010, 2:28am UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/18 "2010-07-07T02:28:09Z")
> [@spoike](#): > > My iTunes account was hacked three months ago. AmEx called because I’m not in the habit of purchasing all sorts of Avatar-based crap, so it was flagged as unusual activity. The credit card was cancelled, iTunes was informed, and I quickly changed my iTunes password. I didn’t bother changing the credit card info as I was in a hurry. > > Two weeks ago, I got an email receipt from iTunes. The jackass thief had downloaded more stuff, which meant he’d figured out the new password, and that iTunes had allowed charges on a cancelled credit card. How good were the passwords? They weren’t in [this guy’s list of common passwords](http://onemansblog.com/2007/03/26/how-id-hack-your-weak-passwords/) were they? If you had a 15 character password with random mixed case numbers letters and symbols that was never used anywhere else—then they probably aren’t cracking it by brute-force. That would be troubling. It would mean they are getting it through some other weakness in the security model :(. ---
**Author:** ![spoike](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@spoike](https://boards.straightdope.com/u/spoike)\ **Post date:** [July 7, 2010, 5:01pm UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/19 "2010-07-07T17:01:22Z")
> [@minor7flat5](#): > > How good were the passwords? They weren’t in [this guy’s list of common passwords](http://onemansblog.com/2007/03/26/how-id-hack-your-weak-passwords/) were they? > > If you had a 15 character password with random mixed case numbers letters and symbols that was never used anywhere else—then they probably aren’t cracking it by brute-force. That would be troubling. It would mean they are getting it through some other weakness in the security model :(. The first one was a crap password (although not so bad as to make it on that list, mind you), and was definitely my fault. The second one was 12 characters which included mixed case letters and numbers, but no symbols. I’ve never used it anywhere else. It’s possible, I guess, to crack it via brute force, but seems unlikely. I also find it troubling that their system allowed the thief to download a whole bunch of stuff using a cancelled credit card. ---
**Author:** ![Munch](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/munch/32/5281_2.png) [@Munch](https://boards.straightdope.com/u/Munch)\ **Post date:** [July 7, 2010, 6:38pm UTC](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572/20 "2010-07-07T18:38:13Z")
> [@Wordy](#): > > Better take your credit card information off Itunes/AppStore people, it’s been massively hacked and there are cumulating reports of people complaining and reporting stolen money. In this thread: massive exaggerations, overblown reports, and blind computer-partisan (compartisan?) attacks. [Report: Apple iTunes Hack Affected 400 Users Out of 150M](http://www.pcmag.com/article2/0,2817,2366129,00.asp) [Next page](https://boards.straightdope.com/t/widespread-hacking-of-apple-itunes-appstore-accounts/545572.md?page=2)