Hackers promised an iCloud apocalypse — but probably can't deliver

        When the Turkish Crime Family first broke into the news last week, they sounded like a crisis in the making. The group claimed to have stolen a massive trove of iCloud credentials — the first over 300 million, then as many as 559 million — and unless they got $75,000 from the company before April 7th, they would start remotely wiping phones. Apple responded with a limited denial, stating that company servers hadn’t been breached, but allowing for the possibility that the credentials had been obtained some other way. As journalists began to confirm smaller sets of profiles released by the group, it gave Apple users plenty of reason to be nervous. Were we headed toward some kind of mass iCloud hack?
        Now, those threats are starting to unravel. Today, ZDNet examined the largest account drop yet — just under 70,000 login / password pairs — and found that 99.9 percent of the pairs matched accounts already included in a database of previous leaks. In short, the Turkish Crime Family was working from recycled public data. At the same time, Motherboard obtained documents showing the group using the data for a quick cash out, asking for $3,000 from the breach notification site Leakbase in exchange for bringing good publicity to the service. 

        The Turkish Crime Family’s trick was making that credential-stuffing attack seem like something larger and more threatening. By claiming hundreds of millions of accounts and threatening attacks on a specific zero-hour, the old credentials suddenly seemed like an imminent threat — worth paying attention to, and maybe even worth paying for. But as more details came out, that case got weaker and weaker. It’s still hard to say for sure what will happen on April 7th — and again, entirely worth resetting your passwords — but the chances of a hacking apocalypse are looking slimmer by the day.