Massive data breach exposes swath of unencrypted Apple ID logins

Cybersecurity researcher Jeremiah Fowler reported on Thursday about finding a “publicly exposed database [that] was not password-protected or encrypted” and contained over 184 million unique usernames and passwords for services from Facebook, Instagram, Microsoft, Roblox, Snapchat, and more. A report by Wired on Fowler’s findings states that login information for Apple, as well as Amazon, Nintendo, Snapchat, Spotify, Twitter, WordPress, Yahoo, banks, health services, government portals, and more was also found in the database.

Folwer was unable to determine the purpose of the database, and he reported it to the hosting provider, which then restricted public access to it. He was also unable to determine how long the database was publicly available or who had used it. Fowler was able to authenticate the information in the database by using some email addresses that he found and identifying himself as a researcher investigating a data breach.

As Fowler explains, the breach exhibits “multiple signs” that the exposed data was harvested by some type of infostealer malware, which “usually targets credentials (like usernames and passwords) stored in web browsers, email clients, and messaging apps.” As for how the data was collected, Fowler stated that “cybercriminals use a range of methods to deploy infostealers.”

How to protect yourself

Never open links in emails or texts you receive from unknown and unexpected sources. If you get a message that looks like it is from an entity that you do business with, check the sender’s email address and inspect the URL carefully. If you see a link or button, you can Control-click it, select Copy Link, and then paste it into a text editor to see the actual URL and check it.

Phishing attacks often involve a user inadvertently visiting a website with a mistyped URL. So verify the URL you have typed into your browser. Bookmark the sites you visit frequently so you don’t have to type in the URL every time. In some instances, you can use a search engine, type the name of the place you want to visit, and then click on the link after looking at the URL it goes to. For example, type “Macworld” into the search engine you use, and then click on the link that’s designated at www.macworld.com. This way isn’t as efficient, but if you make a typo, you’ll see it in the search and Google will steer you in the right direction.

To protect yourself from malware, avoid downloading software from repositories such as GitHub and other download sites. Apple has vetted software in the Mac App Store and is the safest way to get apps. If you prefer not to patronize the Mac App Store, then buy software directly from the developer and their website. If you insist on using cracked software, you will always risk malware exposure.

Apple releases security patches through OS updates, so installing them as soon as possible is important. It’s also important to update the apps on your Mac, which you can do through the App Store or through the app’s settings. Macworld has several guides to help, including a guide on whether or not you need antivirus software, a list of Mac viruses, malware, and trojans, and a comparison of Mac security software.

Author: Roman Loyola, Senior Editor, Macworld