A former roommate recently admitted that he accessed my MacBook while it was unlocked and looked at private information. He is very technically skilled and has known details about my journals, searches, emails, and possibly texts, so I'm not confident that this was the only time he accessed my devices. I use a refurbished MacBook Pro with an M3 chip and also have an iPhone.
I'm worried that he may have installed remote-access software, a monitoring tool, or even a keylogger. I want to regain control without accidentally bringing anything malicious back onto the computer. What is the safest order of operations for backing up personal files, reinstalling macOS, changing passwords, securing my Apple account and iPhone, and enabling two-factor authentication? Is it safe to use my existing backups, or should I copy documents and photos manually instead?
We currently share his internet connection and router, although I have started using a VPN. Should I stop using that network until I move, and are there any Mac settings or configuration profiles I should check? I may also need to preserve evidence in case I decide to report the unauthorized access.
5 Answers
The most reliable approach is to treat the Mac as untrusted. First, preserve evidence by photographing suspicious settings, unfamiliar apps, login items, profiles, or remote-access permissions before deleting anything. Then copy only personal documents and photos to a newly formatted external drive. Avoid restoring a full system image, old apps, or settings, since those could bring unwanted software back.
From a separate device that he has never accessed, change your email, Apple Account, banking, and other important passwords. Sign out of other sessions, remove unfamiliar trusted devices, and enable two-factor authentication. After that, erase the Mac and reinstall macOS from Recovery. On an Apple silicon Mac, shut it down, hold the power button until startup options appear, select Options, and use Disk Utility and the reinstall process. Reinstall applications manually from official sources and copy your personal files back only after the clean installation is complete.
Do not rely on random antivirus tools or AI scans as proof that everything is safe. Since the person had physical access and is technically capable, a clean reinstall is more dependable. If you are concerned about harassment, stalking, financial accounts, or threats, preserve logs and screenshots and consider contacting law enforcement, a domestic-abuse or technology-safety service, or an Apple technician you trust.
Secure the Apple Account and iPhone separately. Review the list of signed-in devices, remove anything unfamiliar, change the passcode, install the latest updates, and check for unknown VPN or device-management profiles. Review location sharing, account recovery contacts, and any family or parental-control settings you did not create. If you find a profile or management setting you cannot explain, contact Apple Support or a reputable repair professional before removing it.
Before wiping the Mac, check System Settings for unfamiliar users, login items, VPNs, device-management profiles, certificates, and sharing permissions. In General, review Sharing and turn off Screen Sharing, File Sharing, Remote Login, and Remote Management unless you intentionally use them. Also inspect Privacy & Security permissions for unknown apps. These checks can help document what happened, but they are not proof that the system is clean, so a full erase and reinstall is still the safer option.
Take screenshots or photos of anything suspicious first, especially unknown profiles, accounts, or remote-access entries. That may be useful if you report the access later.
A shared router does not automatically let someone read all of your traffic, especially when sites use encryption, and a VPN can provide additional protection. However, you cannot trust the router’s configuration if it belongs to someone who may be monitoring you. Use mobile data or a personal hotspot for password changes and account recovery when possible, and avoid accessing sensitive accounts from the shared network until you move or can reset the router yourself. Also make sure file sharing and network discovery are disabled.
I would change the passwords before using the Mac again, but only from a separate trusted device. If the Mac or phone may have been monitored, anything typed into them could already be captured.