iCloud Hacked? How to Protect Your Photos, Backups and Location

If your iCloud was hacked, first take back your Apple account by changing the password from a trusted device or Apple’s official reset page, and remove any device or phone number you don’t recognize. Then check what the intruder could reach: your photos and shared albums, iCloud backups, Find My location sharing, iCloud Mail forwarding rules, notes, iCloud Drive and saved passwords. Turn off anything they changed, and treat any photos or passwords stored there as possibly seen.

iCloud is the storage side of your Apple account, so the password reset itself is covered in our guide on what to do if your Apple ID is hacked. This guide focuses on the part that follows: your data, who can see it now, and what to do if private photos may have been accessed.

Step 1: Take back the Apple account first

Nothing else sticks until the account is yours again. In short:

1. Change your password from the account settings on an iPhone, iPad or Mac you trust, or through iforgot.apple.com, typed in yourself.
2. Remove unknown trusted phone numbers, email addresses and devices from your account.
3. If you can’t reset the password, use Apple’s official account recovery. It includes a waiting period by design, and there’s no way to pay anyone to shorten it.
4. Secure the email address on the account, since Apple’s reset messages go there. Our guide for when an email account is hacked covers that.

The Apple ID guide goes through each of these in detail, including what to do if you’re locked out. Come back here once you’re signed in again.

What an intruder can see in iCloud

With your Apple account password and a verification code, or a device signed in to your account, someone can usually see whatever you sync to iCloud. That depends on what you have turned on, but commonly includes:

iCloud data	What could be exposed	What to check
Photos	Your whole library, including hidden and recently deleted items	Shared albums, shared library participants, any public links
Find My	Where your devices are, and people you share location with	Location sharing list, devices list, Lost Mode or erase actions
Backups	Device backups that can restore messages, app data and settings to another device	Backups from devices you don’t own
iCloud Mail	Your inbox and the ability to set forwarding or rules	Forwarding, rules, sent items
Passwords and Keychain	Saved passwords, passkeys and Wi-Fi details	Change the most important passwords
Notes, Drive, Contacts, Calendars, Messages	Documents, private notes, contacts and message history	Deleted or added files, shared notes and folders

Advanced Data Protection, if you use it, adds end-to-end encryption to most iCloud categories. It protects your data if Apple’s servers were ever breached, but it doesn’t stop someone who has your password and a code, or a device already signed in to your account.

Step 2: Check your photos and shared albums

Photos are usually the most sensitive thing in iCloud, and sharing features are where an intruder can quietly keep access.

• Shared albums: look at each shared album’s subscribers and remove anyone you don’t know. Check whether a public website link has been switched on for any album, and turn it off if you didn’t set it up.
• Shared Photo Library: if you use one, check who the participants are. Anyone in it can see and add to the shared library.
• Recently Deleted: if photos disappeared, look in the Recently Deleted album, which keeps items for a limited period before removing them for good. Restore anything you want back.
• Hidden album: check it hasn’t been emptied or changed. Make sure viewing it requires your face, fingerprint or passcode.
• Sent photos: look through iCloud Mail sent items and, where you can, Messages, for photos sent to people you don’t recognize.

If intimate photos may have been accessed or shared

This is the fear behind many iCloud searches, and it’s worth saying plainly: if someone got into your iCloud, you are not to blame for what they took. There are real routes to limit the damage.

• Don’t pay or negotiate with anyone who threatens to share your photos. Our guide to sextortion help explains why paying usually leads to more demands, and what to do instead.
• If images have been posted, note where (links, dates, usernames), then report them to each platform. Our guide on how to remove intimate images shared without consent covers platform reports and Google’s removal route for non-consensual explicit imagery.
• Services such as StopNCII.org let adults create a digital fingerprint of an image on their own device so participating platforms can block it, without uploading the image itself.
• If the photos show anyone under 18, don’t save, screenshot or share them. Report the links, and use NCMEC’s Take It Down service.
• For emotional support and specialist help, see our help resources. Consider reporting to the police, and talk to a lawyer about your options, since many US states have laws against sharing intimate images without consent.

Step 3: Check Find My and location sharing

Someone with your Apple account can see your devices on a map and, with the right access, lock or erase them. They may also add themselves to location sharing so they can keep following you after you change your password.

1. In Find My, open the People list and stop sharing your location with anyone you don’t expect to see.
2. Check the Devices list. Remove any device you don’t own. If you’re passing an old iPhone on, remove your Apple ID from the iPhone first.
3. If a device was put in Lost Mode with a message to call a number or pay, don’t do either. Once you’re back in your account, you can turn Lost Mode off yourself.
4. On iPhone, run Safety Check in Privacy and Security settings. It helps you review and stop sharing with people and apps, sign out of other devices and reset privacy permissions.

If the person who got into your iCloud is someone you know, such as a current or former partner, they may be tracking you. Our guide on cyberstalking explains how to document it and get help safely, and Safety Check has an emergency option designed for exactly this.

Step 4: Check backups, mail, notes and passwords

• Backups: in your iCloud storage settings, look at the list of device backups. A backup from a device you don’t own is a sign someone restored or synced a device with your account. Delete it once you’ve confirmed it isn’t yours.
• iCloud Mail: check forwarding and rules, and remove any you didn’t set up. Look at sent items for messages you didn’t send.
• Notes and iCloud Drive: check shared notes and shared folders, and stop sharing with anyone unexpected. If files were deleted, iCloud.com has data recovery options for recently deleted files and for restoring earlier versions of contacts, calendars and bookmarks.
• Passwords: if you store passwords in iCloud Keychain or the Passwords app, assume they may have been seen. Change the most important ones first: your email, bank, mobile carrier and main social accounts.
• Hide My Email addresses: check the list for addresses you didn’t create.

If you want to see exactly what Apple holds, you can request a copy of your data from Apple’s Data and Privacy site. It can help you understand what may have been exposed.

A worked example

This scenario is illustrative, not a real client. Talia notices a new device, “iPad”, in her Apple account and an email saying her account was used to sign in on it. She doesn’t own an iPad. She had reused her Apple password on a fitness app that was breached, and she’d approved a sign-in prompt on her phone without reading it.

1. She changes her Apple account password on her iPhone, removes the unknown iPad and turns down any sign-in prompt she didn’t start.
2. In Photos, she finds a new shared album she didn’t create, with a public link turned on and a few private photos in it. She deletes the album and turns off the public link.
3. She runs Safety Check and finds her location being shared with an unfamiliar contact. She stops sharing.
4. She changes the passwords saved in her Keychain for email and banking, then checks iCloud Mail for forwarding rules.
5. She can’t tell whether the photos were downloaded, so she creates hashes through StopNCII.org and makes a note of the dates in case she needs to report anything later.

The sign-in prompt was the step that let the intruder in. Apple’s two-factor prompt shows a rough location, and approving one you didn’t start hands over access.

Common mistakes

• Changing the password but leaving shared albums, location sharing or the unknown device in place. Those keep access open.
• Approving a sign-in prompt you didn’t start. Deny it and change your password.
• Deleting evidence before you’ve recorded it. Note dates, album names and device names first.
• Paying someone who says they have your photos. Payment rarely ends the demands.
• Paying a “recovery service”. Only Apple can restore your account, and it does so for free.

How to keep iCloud private

• Use a unique Apple account password in a password manager, and never approve sign-in prompts you didn’t start.
• Review shared albums, shared libraries and location sharing a few times a year.
• Consider Advanced Data Protection, a recovery contact or a recovery key, but only if you understand how you’d get back in if you lost access.
• Turn on Stolen Device Protection on iPhone where available.
• Check whether your email appears in known breaches with Have I Been Pwned.

If private photos or information from your iCloud have ended up online and in search results, our personal reputation management team can help with removal requests and cleanup where platform rules and the law allow. The universal checklist for every account is in our hub on what to do when your account was hacked.

Frequently asked questions

How do I know if my iCloud has been hacked?

Look for Apple emails about sign-ins or changes you didn’t make, unknown devices in your account, shared albums or location sharing you didn’t set up, forwarding rules in iCloud Mail, or photos and files that were added or deleted. Check in your device settings, not through links in messages.

Can someone see my photos if they hacked my iCloud?

If iCloud Photos is turned on and they have access to your account, they can usually see your photo library. Change your password, remove unknown devices, and check shared albums and shared libraries, since those can keep access open after a password change.

Is iCloud hacked the same as Apple ID hacked?

They’re the same account. Your Apple account is the login, and iCloud is the storage and syncing tied to it. Recover the account first through Apple’s official routes, then check the iCloud data the intruder could reach.

What should I do if my iCloud photos were leaked?

Don’t pay anyone who threatens you. Record where the images appear, report them to each platform and to Google’s removal route for non-consensual explicit imagery, consider StopNCII.org, and see our help resources for support. If anyone in the images is under 18, report the links and use NCMEC’s Take It Down.