Someone obtained my iCloud password through an old data breach connected to one of my email accounts. They accessed private videos, photos, and my phone contacts, then sent blackmail messages from multiple spam accounts. I contacted local police before responding or paying, but the attackers later distributed the photos anyway. Apple has helped secure the account, and the police opened an investigation after I provided evidence, but I'm worried about the images being misused and unsure what practical steps I can take next. I'm an adult—what should I do now to protect my accounts, report the abuse, and limit further distribution?
3 Answers
This is sextortion and non-consensual distribution of intimate images, even when the victim is an adult. In the U.S., report it to the FBI through its official sextortion guidance or local field office as well as your local police; one agency declining to act doesn’t mean you can’t make a federal report. You can also report the image abuse to the National Center for Missing & Exploited Children’s Take It Down or StopNCII, depending on eligibility, so participating services can detect and block matching images.
Ask the police how your evidence is being stored and whether you can provide copies without repeatedly handing over your personal devices. Keep a written timeline of the breach, contacts from the extortionists, and every report you make. Consider telling close contacts briefly that your accounts were compromised and that suspicious messages or links should be ignored. If the images appear in search results or on a specific site, use that service’s privacy or copyright-abuse reporting process to request removal.
Don’t respond, negotiate, or pay them. Save the messages, sender addresses, timestamps, payment demands, and any URLs in a separate evidence folder, then report the accounts and posts to the platforms hosting the images. Contact Apple again if you notice unfamiliar devices, trusted numbers, recovery changes, or forwarding rules. Change your Apple Account and email passwords to unique ones, enable two-factor authentication, sign out unknown sessions, and check whether the old password was reused anywhere else.
I’m concerned the FBI won’t take an adult case, but I’ll still submit a report and keep the local case number and evidence. My main worry is that the images will keep spreading.