Update: Called Apple today and according to them they could not get an IP-address from user logins or was not allowed to give that out. They also said that I would be able to see any message that had been sent from iMessage on any other logged in device. Since I did not see anything the attacker did not send any messages.
Original: First of all I hope this question fits the scope of "can be answered, not just discussed" and I don't want this to be closed as too broad so this is strictly Apple ID even if it in most cases can be the same for other online accounts.
Background story is I was using the iPhone (4) five years ago but has since been using Android. Two weeks ago I decided to go back and try out the new iPhone 7+ since Samsungs recent phones have been burning up.
I then received an email containing the following information earlier this evening. It was in Swedish but it should look like this in English:
Your Apple ID was used to sign in to iMessage on an iPhone 6
Your Apple ID () was used to sign in to iMessage on an iPhone 6 named "iPhone".
Date and Time: November 12, 2016, 13.44 PST
Operating System: iOS 9.2.1
If the information above looks familiar, you can disregard this email.
If you have not recently signed in to an iPhone 6 with your Apple ID and believe someone may have accessed your account, go to Apple ID (https://appleid.apple.com) and change your password as soon as possible.
If anyone thinks this is a phishing email like this, all URL links led to apple.com or a sub domain of apple.com. I think this was real. I acted on it 10 minutes after receiving it, immediately after reading.
My first actions were the following:
- Login to my account and reset the current password. This required answering my security questions which should have slowed a hacker down.
- Check the Account tab so that no other email address or phone number was added as back up email or rescue email. This was not the case.
- Check the Devices tab for signed in devices at: https://appleid.apple.com/account/manage. I could only see my device there and not an iPhone 6.
- Check credit card for any transaction, nothing here. Turned out my account had an expired credit card anyway but It could have been an active one.
- Check order information to see that nothing has been ordered in my name. Nothing here either.
- Check iMessage if anything had been written, nothing.
- Check iCloud for back up of attackers iPhone, nope.
- Check Find My iPhone on icloud.com for attackers iPhone, no luck.
- Looked for an email to contact Apple but it seems phone was the only alternative. Since nothing has happened on the account I decided not to call.
- Tried to set up two-step verification but since my password had been changed I was not allowed to do that. Will do as soon as it is possible:
"You must wait 3 days before enabling two-step verification. For security reasons, you cannot set up two-step verification immediately after significant changes have been made to your account. This helps ensure that only the owner of this Apple ID can set up two-step verification.
A notification email will be sent to all addresses on file in your account."
Luckily I had a unique password for my Apple ID so no other service should be compromised. I normally use a complex generated password in a password manager but I had not started using that five years ago when the account was created and I did not update the password since it was unique anyway. I'm also using two step verification wherever I can normally but I had not yet implemented it here.
Have I forgotten anything to do and can I do anything more to track this down?