Change your iCloud password immediately

In recent days, some news reported that iCloud accounts were suspected being hacked, causing personal information leakage. This incident is under investigation by law enforcement. To apply the best protection of data for user, HKCERT is informing users to change passwords immediately.

If an attacker compromises an account password on iCloud, he could login the iCloud account and access the user's private information. We strongly recommend iCloud users to change their password immediately, and set up two-step verification¹. If a user is using the same ID (email address) and password on other online services, it is time to change them and use different new passwords for each service.

Here are some tips for choosing a good password.

• Use at least eight characters long password.
• Use combination of different character types in a password, e.g. upper and lower case letters, numeric and symbol characters.
• Use passwords that are hard to guess but easy to remember.
• Change your password regularly.
• Do not use the same password for different online services.

If user worries about the risk of information leakage in the iCloud service, they can turn off the auto synchronization² service(s), such as Photos Stream, iCloud Keychain, etc. As a good practice, user should not upload any sensitive information to the cloud.

Other attackers may take advantage of this incident and send out phishing email or perform social engineering attack. Never change your passwords by clicking the URL in an email that you did not request. You should also be cautious when you receive posts or messages with suspicious URLs, even if the sender claims to be your friends. Check the URLs before you click on it.