A group of hackers is threatening to wipe data from millions of Apple devices in two weeks if the company doesn’t pay them US$150,000.
The group, which calls itself Turkish Crime Family, claims to have login credentials for more than 627 million icloud.com, me.com and mac.com email addresses. These are email domains that Apple has allowed for users creating iCloud accounts over the years.
Even though the Turkish Crime Family hasn't been in the media spotlight before, its members claim that they've been involved in selling stolen online databases in private circles for the past few years.
The group said via email that it has had a database of about 519 million iCloud credentials for some time, but did not attempt to sell it until now. The interest for such accounts on the black market has been low due to security measures Apple has put in place in recent years, it said.
Since announcing its plan to wipe devices associated with iCloud accounts, the group claimed that other hackers have stepped forward and shared additional account credentials with them, putting the current number it holds at over 627 million.
According to the hackers, over 220 million of these credentials have been verified to work and provide access to iCloud accounts that don't have security measures like two-factor authentication turned on.
This was determined by testing the credentials using automated scripts and a very large number of proxy servers to avoid getting banned by Apple, the hackers said.
Initially the group asked Apple for the equivalent of $75,000 in Bitcoin or Ethereum cryptocurrency. The ransom value has been raised to $150,000 and the group intends to increase it further if Apple doesn't pay in three days.
News website Motherboard reported seeing alleged emails between the hackers and Apple in which a member of the company's security team said that the company does not plan to reward cybercriminals for breaking the law and that the communications have been archived and sent to the authorities.
Apple did not immediately respond to a request for comment.
In the absence of payment, the group plans to launch an automated attack on April 7 that would log into iCloud accounts and wipe their contents and the devices associated with them.
"We are doing this because we can and mainly to spread awareness for Karim Baratov and Kerem Albayrak, which both are being detained for the Yahoo hack and one of them is most probably facing heavy sentencing in America," a representative for the group said via email. "Kerem Albayrak on the other hand is being accused of listing the database for sale online."
Sign up for Computerworld eNewsletters.