Apple Claims Celebrity Photo Leak Due to ‘Targeted Attack’ and Not iCloud Flaw

In the aftermath of this week’s high profile celebrity photo leak, Apple has issued a statement claiming that any of the photos stolen from victims’ iCloud accounts were the result of a “very targeted attack” and not part of a broader security hole or breach:

We wanted to provide an update to our investigation into the theft of photos of certain celebrities. When we learned of the theft, we were outraged and immediately mobilized Apple’s engineers to discover the source. Our customers’ privacy and security are of utmost importance to us. After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone. We are continuing to work with law enforcement to help identify the criminals involved.

While many questions remain as to the source of the leaks, there are multiple reports that the majority of the photos were stored on iCloud, Apple’s cloud-based data syncing and storage service, with some of the victims placing public blame on Apple itself. Apple unsurprisingly responded to the situation quickly, but the company’s written statement may not be enough to turn the tide of the rising anti-Apple sentiment growing amongst the fans of celebrities targeted by the attack.

To make matters worse for the company, Apple is holding a product announcement event next Tuesday in Cupertino, one that many anticipate to be a major push into a new category of wearable devices. Any fallout from this week’s leak, deserved or not, will place a highly unusual pall over the company’s announcement.

If Apple’s assessment of the leak is accurate, the victims of this unfortunate event likely fell prey to typical security pitfalls such as phishing or the use of a weak password. iCloud users (along with users of any password-protected service) are urged to use strong passwords and enable additional security measures such as two-factor authentication.