Statement from BlueToad regarding the cyber attack suffered in the recent case of stolen Apple UDIDs
A little more than a week ago, BlueToad was the victim of a criminal cyber attack, which resulted in the theft of Apple UDIDs from our systems. Shortly thereafter, an unknown group posted these UDIDs on the Internet.
Context & Ripple Effects
The leaked-device-ID episode began with AntiSec’s claim that more than one million Apple IDs came from an FBI breach, followed by Apple’s denial that it had supplied device IDs to the FBI. BlueToad’s account redirects the immediate provenance question from Apple and the FBI to a third-party custodian.
The disclosure matters because the identifiers were held outside Apple’s own systems and then posted publicly after the breach, making data stewardship by companies in Apple’s ecosystem the central issue.
First-order effects
- BlueToad must account for the compromise of the Apple UDIDs it stored, while the leaked dataset’s source is no longer supported by the earlier FBI-attribution claim.
- Apple gains a factual basis for its position that it did not provide the leaked identifiers to the FBI.
Second-order effects
- Companies that collect or retain Apple device identifiers face sharper scrutiny over why they hold that data and how they protect it, since a breach at one custodian can become an Apple-wide privacy story.
- Apple’s partners and customers have an incentive to separate Apple’s platform from third-party data handling when responding to questions about identifier collection.
Third-order effects
- The episode points toward accountability for the full chain of custody around mobile identifiers: platform privacy assurances can be undermined by the security practices of downstream holders.
- If similar disclosures recur, firms may face pressure to minimize retained device-identification data rather than treat it as routine operational inventory.
The trend: Mobile-data privacy is becoming a supply-chain security issue, with responsibility extending from platform owners to every company that stores persistent device identifiers.