My traumatic Apple ID hack showed pitfalls of centralized identity

As a crypto investor who has gone through the traumatic experience of having my Apple ID stolen and my digital assets liquidated, I cannot stress enough the importance of taking proactive measures to protect your digital identity. My background as a tech entrepreneur and understanding of the importance of security protocols did not shield me from this audacious attack. The incident caused significant emotional and financial damage, despite my efforts to stay vigilant.


Last year, I, as a tech entrepreneur with a strong background in the industry, was unfortunately the target of a complex hacking attempt on my Apple ID. This intrusion brought about substantial emotional and financial hardships for me. Despite my awareness of the significance of multi-factor authentication and the red flags associated with SIM swaps, I had taken necessary precautions to protect myself. However, one fateful January evening, despite my best efforts, I was outmaneuvered by a particularly cunning attacker, serving as a stark reminder that no one is completely immune to such threats.

For decades, I’ve been a dedicated Apple ID user, amassing an impressive inventory worth tens to hundreds of thousands of dollars from software purchases, movies, TV shows, and hardware. Out of the blue, I received an alarming notification: approximately 15,000 unauthorized login attempts had been detected. The notifications came in rapid succession, like a series of booming alarms: “Deny access, deny access, don’t grant entry.”

Subsequently, I received a call from an individual purporting to be from Apple tech support. They possessed detailed knowledge about my device inventory, including usage history and geolocation data of recent login attempts. Many people might have found this contact convincing, but I felt uneasy. He announced, “I will send you a code,” to which I retorted, “I won’t provide it to you.”

As a researcher, I received codes on my phone from an familiar number that Apple had previously used for verification codes. I was alarmed and decided to contact Apple directly to understand the cause of this unexpected occurrence. However, my concern deepened when I discovered that an intruder had successfully breached my account.

The woman from Apple essentially urged me to concede to my misfortune. But I’m technically proficient and understood that my Apple ID could be irretrievably lost. However, this realization didn’t diminish the significance of other issues at hand. My non-fungible tokens (NFTs) and art, which I had acquired over two years, were at risk. In addition, I managed numerous corporate and brokerage accounts. Her continuous insistence on “accepting my loss” seemed dismissive of the gravity of the situation.

My traumatic Apple ID hack showed pitfalls of centralized identity

In the rush to secure my funds before time ran out, I transferred my traditional money to a secure place. However, my cryptocurrencies had already been sent to a wallet outside of my possession and were subsequently sold off. Suddenly, an ominous message came through on Telegram from an unknown caller, their voice altered with a chilling effect: “Look there now.”

As an analyst, I received messages threatening to return my Apple ID and assets in exchange for the phone numbers and email addresses of three individuals. However, I chose not to comply with their demand, asserting that they had targeted the wrong person.

In response to the unfolding situation, I initiated posting updates on Twitter. However, this action unsettled the hacker, who then made menacing threats to disseminate photographs of my four-month-old baby. Consequently, I decided to remove the tweet.

The communication persisted, and I received the news that my Apple ID would be restored if I avoided posting anything online for the next 48 hours. However, just three days later, the demands of the attacker underwent another change. Now they were asking for a ransom of $50,000.

As a crypto investor, I often uncover information about individuals or organizations that may be involved in questionable activities or possess sensitive data. By leveraging this knowledge discreetly and ethically, I can potentially profit from the situation without resorting to extortion or wrongdoing.

Months of terror

During the next three-month period, I endured efforts from the harasser to extort and intimidate me, which I had to keep hidden from my wife and daughter. Unfortunately, my situation grew more complicated as my Amex and Chase withdrawal limits were significantly reduced, and my credit score took a steep decline.

Unwavering in my determination, I persisted in communicating with the imposter who had assumed my identity, amassing vast amounts of data as proof.

As I delved deeper into the investigation, I discovered that the walls were closing in on the suspected attacker. This individual had previously been indicted for a SIM swap offense, but it seemed this was just the beginning of their nefarious activities. My stolen funds had been traced to Cash App and Venmo transactions, allowing investigators to link the dots and identify me as a victim.

Later on in the investigation, it was uncovered that approximately 20 additional victims existed. A majority of them were women. This individual would coerce many of them into engaging in sexual acts. I received a disturbing phone call from the sentencing officer who expressed deep unease. She explained that despite her extensive experience dealing with serial killers, murderers, and other malevolent individuals, her encounter with this person left her with an unmatched sense of dread.

Among the victims, I was the one who wasn’t intimidated and bravely testified in court by submitting a written statement. The impact of those words was significant, resulting in the judge increasing the sentence to eight years without the possibility of parole, even though the hacker had confessed and named his accomplices. A federal trial is underway, ensuring that he will be incarcerated for an extended period. It’s unfortunate that his life will be wasted in this manner.

Protect your digital identity

It was one of the most traumatic experiences of my life.

Many individuals worldwide rely heavily on their Apple IDs in their everyday lives, often unknowingly. The potential harm caused by a hack to this digital identity is significant, much like the consequences of having one’s social security number compromised. I never considered Apple as my digital identity until it was already breached.

As a seasoned crypto investor, I’ve come across schemes where individuals pose as recruiters for reputable companies like Apple. They advertise job openings enticing unsuspecting victims to apply. Believing they are joining legitimate organizations, these individuals become unwitting participants in financial crimes instead.

As a concerned crypto investor, I strongly believe that advanced speech recognition technologies require immediate improvement to ensure greater security for all users. The ease with which someone’s voice can be replicated and misused within half an hour is a concerning reality we must address.

In the realm of Web3, digital identities serve as the essential base for secure and authentic interactions. Without them, identifying and confirming one’s counterpart becomes a significant challenge. Our current communication infrastructure, both as a society and as a civilization, leaves much to be desired in terms of security and privacy.

As a dedicated researcher who has recently gone through the process of obtaining a refund from Apple for my accumulated purchases spanning over two decades, I’m deeply committed to ensuring that others don’t encounter similar situations. Here are some valuable tips based on my experience:

  • Keep a strict timeline and take rigorous notes
  • Make sure law enforcement official you speak to takes notes as well
  • Write down the date and time of the call, as well as their name and details
  • Contact local police and tell them what happened to you
  • File a detailed IC3 report, as this helps federal authorities apprehend criminals

Having gone through the devastating consequences of having my digital identity compromised unexpectedly, I am convinced that the solution lies in decentralized identities. In this system, my personal data would be fully encrypted and safely stored in a secure digital wallet under my control, eliminating the need for centralized authorities to hold and potentially misuse my information.

Amro Shihadah is a guest columnist for CryptoMoon and a former director of operations at Nillion, and is a finance professional with expertise in traditional finance and blockchain and AI technologies. He holds an undergraduate degree in finance and business administration from American University and is completing an executive MBA at Northwestern University’s Kellogg School of Management.

I’d like to clarify that the following content is intended to provide general knowledge and should not be construed as legal or investment advice. The perspectives, interpretations, and viewpoints expressed are mine alone and do not necessarily align with those held by CryptoMoon.

Read More

2024-05-07 22:57