My former partner seems to know things from my phone, including private texts, photos, and possibly my location. They even referred to a text I sent to my boss, despite not knowing my boss or having met them. This is a newer phone, and I don't believe they've ever had physical access to it. I changed my iCloud password and checked the visible sharing and access settings, but I haven't found anything unusual. How could they still be seeing this information, and what steps should I take to secure my phone and accounts?
3 Answers
Start by documenting exactly what they know and when they mention it. That can help distinguish direct access from guesses or information they’re getting elsewhere. If they know the contents of private texts, treat your Apple account, email, password manager, and messaging accounts as potentially compromised. Change passwords from a trusted device, enable two-factor authentication, and use each service’s option to sign out of all other devices and browser sessions. Check for unfamiliar trusted devices, recovery numbers, forwarding rules, and shared accounts.
Because this may involve stalking or unauthorized monitoring, focus on safety as well as technical cleanup. Save screenshots and write down dates, statements, and account alerts before resetting anything. If you think the person could react badly, make changes from a trusted device and consider contacting a domestic-violence or stalking support service for a safety plan. You can also report suspected unauthorized access to law enforcement or your mobile carrier, especially if there are threats or continued access after you secure the accounts.
If you can safely do so, back up only the important personal data and perform a full factory reset, then set the phone up as new rather than restoring every setting or unknown app. Update the operating system first, use a new device passcode, and avoid letting anyone else know it. Also review location sharing, photo albums, family or household sharing, installed configuration profiles, VPNs, and Bluetooth connections. Change your main email password too, since email access can be used to reset other accounts.

Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures