A former roommate recently admitted that he accessed my unlocked MacBook Pro while pretending to help with a project and viewed private material. He is very technically knowledgeable and has previously known details about my journals, searches, email, and possibly texts, so I'm not sure whether he accessed the laptop once or had another way in. I'm worried about remote-access software, monitoring tools, or even a keylogger, and I don't know how much access he may have had to my iPhone while it was unlocked.
What is the safest order of operations for securing everything? Should I change passwords first, reinstall macOS, or use another device? Is it safe to copy documents and photos to an external drive, and should I avoid restoring a full backup? I also use his internet router and have started using a VPN, but I'm wondering whether I should stop using that network until I move. I'd appreciate practical steps for making my Mac, iPhone, accounts, and files private again.
5 Answers
A shared router does not automatically let someone read all of your encrypted web traffic, especially when sites use HTTPS, and a reputable VPN can add protection. Still, you don’t control that router, so using your own mobile hotspot or another trusted network until you move is a reasonable precaution. Don’t log into sensitive accounts from a device or network you suspect is being monitored, and change the router’s settings only if you are the authorized owner.
Before wiping anything, consider documenting what happened if you may need help from law enforcement, a landlord, or a lawyer. Photograph unfamiliar applications, login items, sharing settings, device-management profiles, and suspicious account activity. On the Mac, check System Settings for Sharing, Screen Sharing, File Sharing, Remote Login, Remote Management, Login Items, and Privacy & Security permissions. However, manually deleting suspicious software is less dependable than a complete erase and reinstall.
The most reliable approach is to back up only personal files you recognize, such as documents and photos, to a clean external drive, then erase the Mac and perform a fresh macOS installation from Recovery. Reinstall applications manually instead of restoring the entire system or blindly importing old settings, since a full restore could bring unwanted configuration or software back. After the reinstall, update macOS and install apps only from trusted sources.
Treat the iPhone separately. Install the latest iOS update, use a strong device passcode, review Apple Account devices, remove unfamiliar VPN or device-management profiles, and check Family Sharing and other account-sharing settings. If you believe the phone was unlocked and altered, back up only essential personal data and perform a factory reset rather than restoring an unknown configuration wholesale.
Change important passwords from a device you trust, not from the possibly compromised Mac. Start with your primary email and Apple Account, then banking, cloud storage, and everything else. Use unique passwords stored in a password manager and enable two-factor authentication wherever possible. Review account sessions, trusted devices, recovery addresses, forwarding rules, and security notifications, and sign out of devices you don’t recognize.
It’s best to do the password changes before using the cleaned Mac for normal activity, but only from a device that the roommate couldn’t access. Once the Mac and phone are secured, change any passwords that were entered during the uncertain period again if necessary.