Apple apologizes for the hacking of some Apple IDs in China in phishing scams, says the victims hadn't enabled two-factor authentication
Apple apologized over the hacking of some Chinese accounts in phishing scams, almost a week after it emerged that stolen Apple IDs had been used to swipe customer funds.
Context & Ripple Effects
Apple's apology lands days after Alipay and Tencent disclosed that hackers used stolen Apple IDs to drain customer funds, with Alipay publicly stating at the time that Apple hadn't fixed the problem. By attributing the breaches to users who hadn't enabled two-factor authentication, Apple is framing an opt-in security setting as the fault line — while still conceding enough to apologize.
The episode also extends a rough 2018 for Apple's China posture: in January it had to walk back an iCloud data-migration email sent in error that told some overseas users their data would move to a Chinese company's servers. The through-line is that Apple ID security in China became a payments problem, not just an account problem.
First-order effects
- Chinese users whose Apple IDs are linked to Alipay or WeChat-style payment channels bear the immediate loss exposure, since a phished ID doubles as a wallet credential; Apple's remedy is telling them to switch on two-factor authentication rather than changing defaults.
Second-order effects
- Alipay and Tencent, having already gone public with complaints that Apple hadn't fixed the issue, now hold leverage over the Apple ID payment integration — tightening verification on Apple-linked transactions or repricing that channel is their obvious response.
Third-order effects
- Once an ecosystem login is also a payment rail, authentication stops being Apple's private choice and becomes shared liability across its fintech partners — a structural pressure toward making two-factor the default. The later wave of MFA bombing attacks against Apple users shows the corollary: as strong auth spreads, phishers shift to attacking the approval flow itself, making account-recovery policy the next battleground.
The trend: As the Apple ID evolves from device login into a payment credential, account-security failures migrate onto Apple's fintech partners and push authentication from opt-in convenience toward enforced default.