Anything else I should do after an Apple ID sign-in attempt?

Check that two-factor authentication is on, then review the trusted phone numbers and recovery options on your Apple Account. Remove anything you don’t recognize. Also secure the email account associated with it, especially if it shared the old password.

Keep an eye out for more prompts and don’t approve any you didn’t initiate. For a fuller checklist, look up Apple’s official guidance for a compromised Apple Account.

The location in a sign-in alert isn’t necessarily the person’s actual location. It can be affected by how their connection is routed. The alert alone doesn’t tell you who it was or whether they got into the account.

If you see an unfamiliar device, account change or other sign of access, contact Apple Support through its official app or website.

Lockdown Mode was suggested as an extra precaution, but it’s an extreme protection intended for people who may face highly targeted attacks. A sign-in prompt by itself doesn’t establish that you need it, and it restricts some device features.

If any Apple device is actually missing, check its status in Find My and consider marking it as lost. That’s a separate issue from the sign-in alert, so there’s no reason to assume a lost device caused it.