If someone gets into your iCloud

What your Apple Account password actually unlocks

Your Apple Account (what used to be called Apple ID) is a single key, but the password alone isn’t normally enough to turn it. Apple’s guide to two-factor sign-in is explicit: “Whenever you sign in to your Apple Account on a new device or browser, you’ll confirm your identity with your password and a six-digit verification code,” sent to a trusted device already on the account or by text or call to a trusted number. Knowing the password — because someone knew it, guessed it, watched you type it, or found it saved — isn’t by itself the same as getting in.

What actually gets an intimate partner or ex past that second step is one of a few realistic situations: access to your unlocked phone or another trusted device, even briefly, to see the code when it arrives; their own device already trusted on the account from when the relationship was fine; control of your phone line or SMS, so the code goes to a number they can read (see the SMS-forwarding check below); or an already signed-in, authorized browser session on a shared computer that never needs a new code.

Any of those, combined with the password, gets someone into iCloud.com from a browser, or lets them add your account to a second device. From there they can reach a surprising amount of your life:

• Photos. Everything in iCloud Photos, including shared albums.
• Messages in iCloud. If you have this turned on, your text conversations sync across devices and are stored in the cloud rather than only on your phone — Apple’s guide to Messages and iCloud explains that messages are stored in the cloud, and sending, receiving, or deleting on one device updates everywhere.
• Notes, Mail, Contacts, and Calendars.
• iCloud Drive — any documents stored there.
• Find My location of every device on the account — not a person’s real-time GPS pin, but every iPhone, iPad, Mac, Apple Watch, and AirTag tied to that Apple Account, viewable by signing in to Find Devices on iCloud.com.

Device backups work differently. A backup isn’t a folder you can browse on iCloud.com. Apple’s explanation of what iCloud Backup includes describes it as a copy of “information on your iPhone, iPad, and Apple Vision Pro that isn’t already synced to iCloud” — app data, device settings, and, only if Messages in iCloud or iCloud Photos are off, your messages and camera roll. Anything already syncing through those two features is handled by the sync systems above instead. To reach a backup at all, someone needs a device to restore it onto — Apple’s restore instructions require erasing an already-set-up device first, then walking setup to “From iCloud Backup,” a far more visible, disruptive step than quietly opening a browser tab.

Keychain (saved website and app passwords) needs more than this. iCloud Keychain syncs your saved passwords, passkeys, and Wi-Fi passwords end-to-end encrypted, and Apple’s security documentation states this data can’t be read by Apple and stays protected even if the iCloud account is compromised. Seeing your saved passwords through Keychain requires access to one of your actual trusted devices and its passcode, not just the account password and a code.

If you recognize your situation in this — someone who has or had your password, and possibly still has access to a shared or trusted device, your phone line, or an open session — read Safety first: before you remove anything before you change a single setting. Locking someone out can be the right move, but it can also be the moment they realize you know, and that moment needs a plan.

What notifications Apple actually sends

A common assumption is that Apple will always alert you the instant someone else logs in. The real picture is narrower.

When two-factor authentication is on and someone signs in on a device that isn’t already trusted, Apple’s Personal Safety Guide says a notification goes to your other trusted devices, including a map of the new device’s approximate location — based on IP address or network, not exact GPS — and you can select “Don’t Allow” to block it. That guide describes new-device sign-ins specifically; a not-yet-authorized browser sign-in likely triggers the same notification since it needs the same password-plus-code step, but that’s our inference, not something Apple’s page states for browsers.

Apple’s guidance on what to do if your Apple Account has been compromised lists the signals to watch for: a notification or email about activity you don’t recognize, a two-factor code you didn’t request, messages you didn’t send, deleted items you didn’t delete, or trusted devices you don’t recognize. These depend on Apple detecting the activity, and on you seeing the notification before it’s dismissed on a device the other person also has access to.

Our own observation, not something Apple states outright: we could not find a page in your account settings that shows a complete historical login audit log — every sign-in, timestamp, and IP address, going back further than your current device list. You get the device list itself (current devices, not a history of past ones) and whatever real-time notifications fired. If someone signed in weeks ago and you dismissed or never saw the alert, there generally isn’t a page to check that after the fact.

Checking who has access right now

1. Review your device list. On iPhone or iPad: Settings → [your name], then scroll down to see every device signed in. On Mac: Apple menu → System Settings → [your name]. On the web: sign in at account.apple.com and select Devices. Select any unfamiliar device and choose “Remove from Account.”
2. Confirm your recovery contacts and phone numbers. Apple’s compromised-account guidance recommends checking with your email provider and cellular carrier to make sure you control every email address and phone number tied to the account — including confirming that SMS forwarding hasn’t quietly been set up on your number.
3. Check Family Sharing membership. If you’re in a Family Sharing group with the person you’re concerned about and location sharing is on, Apple’s Family Sharing location guide confirms family members see each other’s device locations in Find My once sharing is enabled; shared App Store, Apple Books, and iTunes purchases are also visible to the group while you’re in it.

What Advanced Data Protection changes

Advanced Data Protection for iCloud is an optional setting that raises the number of iCloud data categories protected with end-to-end encryption. Under Apple’s default (standard) protection, encryption keys for most categories sit in Apple’s data centers, which is what lets Apple help you recover data if you’re ever locked out. With Advanced Data Protection on, Apple’s security documentation states the end-to-end encrypted category count rises from 14 to 23, including iCloud Backup, Photos, and Notes — and Apple no longer holds the keys to decrypt that data.

Two effects matter here:

• Web access changes. Turning on Advanced Data Protection automatically turns off web access to your data at iCloud.com, because Apple’s web servers no longer hold the decryption keys. You can turn it back on, but each time, you must authorize that sign-in from a trusted device, and Apple shows a notification naming the iCloud service being made temporarily available.
• Some categories are never end-to-end encrypted, even with ADP on. iCloud Contacts, Calendar, and Mail aren’t end-to-end encrypted, since they interoperate with the global email, contacts, and calendar systems non-Apple services use.
• Recovery risk cuts both ways. Apple’s own guidance states, “With Advanced Data Protection turned on, Apple doesn’t have the encryption keys needed to help you recover your end-to-end encrypted data” — instead, “you’ll need to use one of your account recovery methods — your device passcode or password, your recovery contact, or recovery key.” That’s a real trade-off: it locks an attacker with only your password out of your most sensitive categories, but also leaves you no fallback if you lose your devices without recovery contacts set up. See the account-layer section of the complete iOS security guide for how to weigh that trade-off.

Advanced Data Protection doesn’t change what someone can see if they’re signed in on one of your trusted devices, or if they have your device passcode — end-to-end encryption protects data in Apple’s cloud, not data already unlocked in front of someone standing next to your phone.

The 2014 case that shows what “someone in your iCloud” really looked like

The clearest documented example of an intimate-adversary-style iCloud compromise at scale isn’t intimate-partner stalking — it’s the 2014 celebrity photo-theft prosecutions. The method matters because it’s the same one used against ordinary people: not a “hack” of Apple’s servers, but phishing for passwords.

The Department of Justice’s Central District of California charged multiple people in this scheme. According to the DOJ’s press release on Edward Majerczyk, from November 2013 through August 2014 he “engaged in a phishing scheme to obtain usernames and passwords for his victims,” sending emails “that appeared to be from security accounts of internet service providers” and directing victims to a site that collected their credentials; he accessed at least 300 accounts, including at least 30 belonging to celebrities, and was sentenced to nine months in federal prison after pleading guilty to a felony violation of the Computer Fraud and Abuse Act. A second defendant, George Garofano, was charged separately — the DOJ’s press release describes a phishing scheme running from April 2013 through October 2014 that gave him “illegal access to over 250 Apple iCloud accounts,” carried out by sending emails “that appeared to be from security accounts of Apple” to collect victims’ credentials, under a plea agreement to one count of unauthorized access to a protected computer.

No Apple server was breached in either case — access came entirely from tricking people into typing their real password into a fake page. That’s the same technique that works against a partner or ex today: a fake “your iCloud storage is full” or “verify your account” email is functionally identical to what these defendants sent. Apple’s guidance on recognizing phishing and social engineering notes Apple never asks for your password or verification code, and suspicious emails claiming to be from Apple can be forwarded to reportphishing@apple.com.

Locking it down — read this before you act

If you share a device, a family plan, or any account with someone you’re worried about, changing your password or removing a device can notify them instantly, cut off access they expect to have, or reveal you’re aware something is wrong. Before any step below, read Safety first: before you remove anything and think through the order of operations — get a safer device or account ready first if you can, and consider what the other person will see change.

When you’re ready:

1. Change your Apple Account password, from a device you’re certain is only yours.
2. Turn on two-factor authentication if it isn’t already on, and add only phone numbers you exclusively control as trusted numbers.
3. Go to your device list (Settings → [your name] on iPhone/iPad, or account.apple.com) and remove every device you don’t recognize or no longer physically control.
4. Leave shared Family Sharing groups if appropriate. Apple’s guidance on leaving a group states that once you leave, “you stop sharing locations with your family members and your devices are removed from the family’s Find My list,” purchase sharing stops immediately, and any photo album, calendar, or reminders you shared with the group stop being shared.
5. Consider Advanced Data Protection once your recovery contacts or recovery key are set up, understanding the recovery trade-off above.

None of this proves a device or account is now clean — as noted above, we couldn’t find a page publishing a complete historical login log, so you’re working from the current device list and whatever alerts fired, not a full audit trail. For broader hardening beyond the account itself, see the complete iOS security guide, and for account-security fundamentals beyond Apple, see securing your accounts when someone knows you.