‘This password has appeared in a data leak’ is one of the worst messages you can get when it comes to privacy. Unfortunately, billions of password leaks have happened before – but that doesn’t mean there’s nothing to do! So, what should you do after an Apple data leak notification?
Changing the compromised password is the first thing to do after an iPhone password leak notification. Looking for every other compromised login credential and doing the same is also a must. Choosing strong passwords and enabling multi-factor authentication prevents that scenario from happening.
Is it time to panic after a password leak? Not at all! There are plenty of things to do to stop threat actors from accessing your accounts. At the same time, you need to find out whether you’ve reused that same password in the past to figure out what to do next. Understanding why these leaks happen helps prevent them in the future.
What Causes a Password Leak?
- Brute Force. Threat actors use brute force attacks to crack passwords. They use computer programs to either guess passcodes one character at a time or employ dictionary attacks to check for common passwords and combinations in a small amount of time. Using a short or weak password allows brute force attacks to succeed.
- Data Breach. Companies suffer data breaches all the time. You could be a victim when that happens: hackers steal and leak login credentials online, and you could find your password in one of those leaks. We’ll explain how to find out if you were a victim of a massive data breach at the bottom of this article.
- Poor Practices. Do you often use a public Wi-Fi network? Do you reuse passwords? You could have your passcodes leaked if you do either of those things. Using common sense and following cybersecurity best practices will keep your privacy away from harm.
Why a Password Leak Notice May Not Be a Reason for Concern
Apple will notify you when they find an exact match between a stored password and leaked passwords found online.
Does that mean having a compromised password is cause for alarm? Yes and no. Yes, it’s cause for alarm because you should never use weak or leaked passwords. No, it’s not cause for alarm because it only means half of your login credentials are compromised.
Remember, your password is half of your login credentials. Hackers need an email or phone number to complete the combination. There should be no cause for alarm if your password was leaked without a matching email.
However, it still means you need to do these seven things just to be sure.
7 Things To Do After Receiving an iPhone Password Data Leak Notification
1. Change Your Password Right Now
Have you suffered a password leak? Then it’s time to change your password. Simple as! Look for a strong, unique password to switch to. We’ll tell you how to create the perfect password in the section below this one if you don’t know how to do it.
Changing your password is Option A. There’s also Option B: deleting the compromised account. You may have suffered a leak from an account you don’t even remember creating, which provides a good opportunity to exercise good cybersecurity habits and delete inactive or forgotten accounts.
The fewer active accounts you have, the lower chance you have of suffering a data leak.
2. Figure Out if You’ve Reused That Password Before
Apple looks for matches on their leaked password database all the time. To do so, they check the passwords you stored using Apple devices.
However, it’s possible you used that password on other accounts – and haven’t used an Apple device to log in. In other words, Apple can’t warn you about compromised accounts if you haven’t used an Apple device to log in.
So, you’ll have to think about whether you have other accounts with the same compromised password – and change your login credentials.
3. Think About Other Weak Passwords You May Use
Finding out about a leaked password is a good opportunity to perfect your cybersecurity habits. Are you reusing the same passcode over and over again? Do you have a short list of passcodes you continue to reuse? That’s problematic!
Remember where you used other passwords and figure out whether they’re weak or not. Delete inactive accounts and figure out the best way to have a “one account, one password” policy. Otherwise, this problem will happen again sooner than you expect.
4. Check for Other Compromised Accounts
One password leak often spreads to other sites if you’re not careful enough. Threat actors will take one leaked passcode and use it anywhere they can.
Have you followed cybersecurity best practices? That means you’ve never reused your passwords! In other words, change the leaked one and move on.
However, most people tend to pick one to three passcodes and reuse them all the time. If that sounds like you, you need to figure out where you have reused your leaked passwords – and deal with that issue.
5. Enable MFA Everywhere You Can
Using MFA (short for multi-factor authentication) is like adding an extra wall to your cybersecurity fortress. It’s there to prevent malicious actors from accessing your accounts – even if they have your login credentials.
Most websites allow MFA nowadays. The only thing you have to do is enable that feature and write down your phone number or email address.
Whenever you access the site from a new device, you’ll get a message or email to confirm your connection. Nobody will access your account without receiving that message or email!
6. Don’t Delay Your Actions
It’s important to act as soon as you realize your password is weak or was leaked. Threat actors tend to buy leaked passwords in bulk and use software to try them as fast as possible; others prefer to filter them and look for high-reward victims that way.
Either way, having a leaked password means it’s only a matter of time until someone tries to access your account. It’s also a good idea to change your email or username because malicious actors will continue to find your leaked password on data breach databases and try to log in using those credentials.
7. Double Check (If You Suspect Something’s Wrong)
Do you suspect something is off after receiving the data leak message? It could be! You could be using a compromised device in one way or another, pushing you to fail into a sophisticated trap.
For example, connecting to a public Wi-Fi could mean you’re connecting to a compromised network. That data leak notice message could be fake and may redirect you to a fake website (also known as website spoofing).
That could also happen if your device is infected with malware. Make sure you double-check that information using a secondary device you can trust (e.g., use your home computer if you received the notification on your phone while connected to a public network), then change your password if it all checks out.
5 Tips To Create a Strong Password
1. Avoid Common Passwords
First things first: never use a common password – because that would defeat the purpose of creating a strong password! There’s a long list of commonly used passcodes, though you can probably guess the top 5: “123456,” “123456789,” “qwerty,” “password,” and “12345.”
You can probably notice a common trend between all five options (and the rest of the items on that list). They are either common keystrokes put together or the word “password.”
Threat actors know common passwords, and they will use them when they try to brute force their way into your account. Avoid them at all costs if you don’t want cybersecurity trouble.
2. Go For Length Over Complexity
Threat actors also have an easier time cracking shorter passwords. Brute forcing or cracking passwords requires a computer and a small piece of software to guess your passcode one character at a time. So, the shorter a password is, the easier it is for a computer to guess it.
Following that line of thought, the longer your password is, the better. However, there’s no need to overdo it. Your passcode should be 10 characters long for you to be on the safer side of things.
A threat actor will need more than 60 years to crack a strong 10-character password.
3. Think About a Passphrase
A one-word password is often not enough to stop threat actors. In contrast, mixing a few words together is often long enough to be secure, but most people tend to forget about them – especially if they’re nonsensical.
How can you create a long password that makes sense? Use a passphrase! Take a long sentence, remove the spaces, and use it as a passcode. The best way to use passphrases you’ll remember is to grab a book and look for a sentence there.
For example, Moby Dick starts this way: “Call me Ishamel.” Remove the spaces and keep the uppercase letters: “CallmeIshmael.” That’s a pretty good, long passphrase! We’ll explain how to improve it below.
4. Add Special Characters To the Mix
A long passphrase puts you ahead of the game, but that’s not enough to stop threat actors from finding out about it. The best move forward is to reinforce your long passphrase by adding a twist to make it unique.
For example, let’s say you’ve decided to use the opening words in Ulysses by James Joyce: “Stately, Plump Buck Mulligan […].” You put them all together and get “statelyplumpbuckmulligan.” That’s a pretty long passphrase!
The best way to perfect it is to add a few uppercase letters, numbers, and special characters. Spice things up in any way you want, as long as you remember it. For example, “5tately!plumpbuckmulligan.” It’ll take hundreds of years for a computer to crack that one!
5. Never Reuse Passwords
Have you gone through the trouble of creating the perfect password – only to allow threat actors to find out about it? It happened to the best of us, though you should know what to do to stop that from happening.
Every password should be used once. That is, you create an account, come up with a password, and never reuse it elsewhere. Doing otherwise (having one or two passwords for all accounts) increases your chances of being fully compromised after one leak.
It’s tough to remember multiple strong, long passwords. Fortunately, you can use a password manager to keep them safe and at a hand’s reach.
How Can I Check for a Password Leak on My iPhone?
The easiest way to check for compromised passwords on your iPhone is to allow your phone to detect compromised passwords. Apple will look for exact matches on data leak lists and warn you whenever your passcode appears there.
How to enable the “Detect Compromised Passwords” feature
- Grab your iPhone or any other Apple device
- Open Settings
- Tap on Passwords
- Open Security Recommendations
- Look for “Detect Compromised Passwords”
- Turn that option on
At that point, you can allow Apple to warn you when you’ve suffered a password leak. You can also allow Apple to let you know when you’re about to use a weak or already-compromised password too.
Checking for Other Password Leaks
Apple isn’t the only company looking out for your password well-being. Other pieces of software, such as Google Chrome, will look for weak passwords whenever you store them. You’ll receive a notification when you store a weak passcode or Chrome finds one long after the fact.
You can also look for leaks the old-fashioned way. In fact, it’s better to be proactive than to wait until Apple or Google warns you of a problem.
How can you look for leaked data? Go to Have I Been Pwned and type any email addresses or phone numbers you’ve used as a login credential in the past. Change your passwords if you’ve found one match or more.
Conclusion
A data leak notification is never a happy occasion – but you can take that unfortunate scenario and turn it into an opportunity to improve your cybersecurity. U.S. Cybersecurity recommends you change leaked and weak passwords into strong passcodes and enable MFA to prevent leaks from hurting you.
