Can Hackers Get Into Your iCloud Photos?
Yes, but almost never by breaking Apple's encryption. People lose cloud photos when someone signs in as them. That takes a phished password, a shared code or a stolen, unlocked phone. Two-factor authentication, a few iPhone settings and care with codes stop most of it.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- The attack is the login, not the server. Whoever signs in as you sees what you see.
- Never give anyone a verification code. Apple sends it only to your trusted devices or trusted phone number.
- Advanced Data Protection limits the damage. Apple can no longer decrypt your Photos, and iCloud.com access is off by default.
How do people actually get into someone's cloud photos?
- Phishing. A fake sign-in page or message asks for your password and then your code.
- Reused passwords. A password leaked from another site is tried on your Apple Account.
- Someone you know. A partner or ex who knows your password, or once had your phone.
- A stolen phone and passcode. Someone who watched you type your passcode can change account settings.
The same patterns apply to Google Photos, Dropbox and other services. The defences below are for an Apple Account.
How do I lock down my Apple Account?
These steps are for iOS 27.
- Check two-factor authentication is on. Settings → your name → Sign-In & Security. Apple's two-factor page says it is the default for most accounts.
- Use a unique password. Do not reuse your Apple Account password anywhere else.
- Consider security keys. Apple's Security Keys page describes them as protection "from targeted attacks, such as phishing". You need at least two keys and iOS 16.3 or later on every device.
- Turn on Stolen Device Protection. Settings → Face ID & Passcode → Stolen Device Protection. It is on iOS 17.3 and later. Apple's page explains the security delay.
- Turn on Advanced Data Protection. Settings → your name → iCloud → Advanced Data Protection. Apple's setup steps require a recovery contact or recovery key first.
- Remove devices you don't recognise. Settings → your name, scroll down to the device list, tap a device, then Remove from Account. Apple's device list page has the details.
What does Advanced Data Protection change for a hacker?
With standard protection, Apple says it can decrypt your photos "on your behalf", such as when you sign in on a new device. A hacker who signs in as you benefits from that.
With Advanced Data Protection, Photos and iCloud Backup are end-to-end encrypted. Apple's two-factor page says a new device might also ask for the passcode of one of your devices. iCloud.com data access is off by default. See Apple's iCloud security overview.
What if I think someone already got in?
- Change your Apple Account password from a device you trust.
- Check the device list and remove anything you don't recognise.
- Assume they saw your photos, and tell anyone affected if the photos involve them.
What this doesn't protect against
None of this helps if someone has your unlocked phone and your passcode before Stolen Device Protection is on. A Shared Album is not end-to-end encrypted, even with Advanced Data Protection. Photos you sent to other people are on their devices and accounts, not yours.
Do it with Cryptile
Cryptile's iCloud backup holds only AES-256-GCM ciphertext. Someone who gets into your iCloud gets files they cannot open without your 9-word recovery phrase. Keep that phrase on paper, not in Notes or Photos.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos. Plus removes the limits for $19.99 a year (7-day free trial) or $39.99 once.