Apple says no personal customer data exposed or compromised in Teenager hack

We reported Thursday how an Australian teenager pleaded guilty to hacking into Apple’s servers after the company notified authorities of the intrusion.

Apple has issued a press statement Friday confirming that no personal customer data was exposed or compromised in the incident.

“We … want to assure our customers that at no point during this incident was their personal data compromised,” the spokesman said.

Apple said that when it became aware of the illegal access, it reported its findings to the FBI, who passed the case to the Australian federal police.

An Apple spokesman said the company’s information security personnel “discovered the unauthorized access, contained it, and reported the incident to law enforcement” without commenting further on the specifics of the case.

The Australian teenager gained access to a central Apple server multiple times over the course of a year. Due to legal proceedings, the exact nature of what was downloaded is still unclear. The individual collected tens of gigabytes of confidential, secure, company files and saved them in a folder named ‘hacky hacky hack’.

That chain of events began when Apple apparently detected the unauthorized access and blocked the source of the intrusions. It subsequently notified the FBI, which passed on the information to the Australian Federal Police, resulting in a warrant being executed at the family home last year.

The Australian Federal Police executed a search warrant on the teen’s home last year, the court heard.
Prosecutors said the raid turned up a “litany of hacking files” on a computer laptop and hard drive, as well as a mobile phone with an IP address that matched the source of the intrusions.

“Two Apple laptops were seized and the serial numbers matched the serial numbers of the devices which accessed the internal systems,” a prosecutor said.

“A mobile phone and hard drive were also seized and the IP address … matched the intrusions into the organisation.

“The purpose was to connect remotely to the company’s internal systems.”

The magistrate’s court acknowledged the guilty plea, and the case has been adjourned until next month for sentencing.