![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/04\/password-reset-hero.png\")
<\/p>\n<\/p>\n
Late Friday, April 26, a large number of Apple users discovered that their Apple ID accounts were locked, and they needed to reset their passwords. Here\u2019s what we know about what happened, and its consequences.<\/p>\n
In this article:<\/em><\/p>\n When I woke up on Saturday morning in the UK, the first thing I saw was a screen on my Apple Watch telling me I needed to sign into my Apple ID. This was surprising, since I wear my Apple Watch to track my sleep, and I was still in Sleep focus mode where the display was turned off. When I looked at my iPhone, I saw a similar notification telling me to sign into my Apple ID.<\/p>\n This can happen if a user makes too many erroneous sign-in attempts, or if someone tries to get into another user\u2019s account. This was apparently not the case, however, because a large number of users were affected by this problem.<\/p>\n When I went to sign in with my Apple ID and password, I was told that my account was locked for security reasons, and then I needed to reset the password. I did this, and, of course, I later needed to enter this new Apple ID password on all my devices: three Macs, two iPads, an iPhone, an Apple Watch, and some HomePods. And I had to re-sign into Apple Music, though, surprisingly, I did not need to do this on my Apple TV. Some users reported that they needed to re-pair their AirPods, but I did not have that issue.<\/p>\n When I looked on my RSS reader, I saw an article saying that Apple users are being locked out of their Apple IDs with no explanation<\/a>. Apparently, for many people, it started around 8pm Eastern time and affected users around the world. The first reports we’re aware of came a little before that; one person posted on X about it<\/a> at 7:42pm Eastern. There\u2019s no reliable way to estimate how many were affected, but forum<\/a> threads<\/a> and comment sections<\/a> suggest that it was widespread. We’re aware of people from multiple countries whose accounts were locked.<\/p>\n For many users, there was just the annoyance of re-authorizing multiple devices and creating new app-specific passwords for third-party apps that access iCloud data<\/a>. But for some, it was more problematic. Michael Tsai explains<\/a> that, since he has Stolen Device Protection<\/a> enabled on his iPhone, and it didn\u2019t recognize \u201cthe location of the home\/office where the phone spends nearly all its time and which is identified as Home in Apple Maps, Contacts, and Find My,\u201d he had to wait one hour before being able to reset the password. As Apple says<\/a>, \u201cStolen Device Protection adds a layer of security when your iPhone is away from familiar locations, such as your home or workplace,\u201d but in Michael Tsai\u2019s case, the only location shown was \u201cthe grocery store that I go to once every two weeks.\u201d<\/p>\n John Gruber on Daring Fireball<\/a> points out a similar problem with significant locations. He says, \u201cthe only two \u2018Significant Locations\u2019 listed [\u2026] are \u2018Work\u2019 and my favorite (and truly oft-visited) grocery store. But the \u2018Work\u2019 location is centered three entire city blocks (~0.2 miles) from my home, which leaves my home just outside the radius that counts as that location. Luckily I wasn\u2019t hit by this account lockout, but this also reassures me that I\u2019m right to not yet have enabled Stolen Device Protection.\u201d<\/p>\n It\u2019s not clear how these significant locations work. You can turn this setting on and see some information by going to the well-hidden settings at Settings > Privacy & Security > Location Services > System Services > Significant Locations. (You\u2019ll have to scroll to the bottom of a couple of lists to find this.) My iPhone shows one recent location, a Costa Coffee in a small shopping center. I never visit Costa Coffee, though I go to the Waitrose supermarket in that shopping center, a couple of times a week.<\/p>\n Significant Locations shows 55 records on my iPhone, but it only shows one recent location. There\u2019s no way to tell the iPhone which locations you want to consider significant, such as your home or work location, so if you have Stolen Device Protection on, you\u2019re at the whim of Apple\u2019s location services.<\/p>\n Given that this issue impacted Apple users from all over the world, one might expect that Apple would respond and explain what happened. Many users were worried that someone had accessed their accounts and rushed to reset their passwords, thinking that their data could be stolen.<\/p>\n It\u2019s still unclear how many users were affected. But users in many countries had this password reset, and some people even reported this problem occurring as late as Sunday. At the time of this writing, in the early morning hours of Monday, April 29, Apple had said nothing. When this article was last updated on Thursday morning, Apple still had not acknowledged the issue.<\/p>\n This event points out one of the risks of the Apple ecosystem revolving around and entirely depending on an Apple ID. As more people depend on iCloud, getting locked out of your Apple ID can have devastating consequences. Without access to your Apple account, cannot use iCloud email, iMessage, or FaceTime without this account. You cannot access personal or even work documents if you store them on iCloud. And you cannot use third-party apps that depend on iCloud, such as a calendar or contacts app.<\/p>\n But, for now, Apple has not really given us any alternative. Your entire personal Apple ecosystem revolves around your Apple ID, so make sure you protect it by using a unique password<\/a> and two-factor authentication<\/a>.<\/a><\/p>\n Each week on the Intego Mac Podcast<\/strong><\/a>, Intego’s Mac security experts discuss the latest Apple news, including security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to follow the podcast<\/strong><\/a> to make sure you don\u2019t miss any episodes.<\/p>\n You can also subscribe to our e-mail newsletter<\/strong><\/a> and keep an eye here on The Mac Security Blog<\/strong><\/a> for the latest Apple security and privacy news. And don’t forget to follow Intego on your favorite social media channels: A large number of Apple users had to reset their Apple ID passwords recently. They were not attacked, and Apple has not explained what happened.<\/p>\n","protected":false},"author":46,"featured_media":100425,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[7],"tags":[679],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n\n
The lockout<\/h3>\n
Signing in again<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/04\/significant.png\")
<\/p>\nApple’s lack of response<\/h3>\n
The risks of the Apple ID: a single point of failure<\/h3>\n
How can I learn more?<\/h3>\n
![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2021\/04\/intego-podcast-artwork-400.jpg\")
<\/a><\/p>\n![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/X-Twitter-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Facebook-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/YouTube-logo-icon-225.png\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Pinterest-logo-icon-225.png\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/LinkedIn-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2024\/03\/Instagram-logo-icon-225.gif\" "\\"Follow"){kind=icon}
<\/a>\u00a0![\"Follow](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2017\/10\/ios9-podcasts-app-tile.png\" "\\"Follow")
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"