Is my iCloud or Apple Mail account hacked? What to check
2 min read · Updated October 15, 2026
Check the devices listed in your Apple Account, review iCloud Mail settings for forwarding and rules, and look for Apple emails about sign-ins you do not recognise. If anything is off, change your Apple Account password, remove unknown devices and confirm two-factor authentication and recovery details.
An Apple Account is more than email
Your Apple Account can unlock iCloud backups, photos, messages, payments and device-finding features. Securing it matters beyond the @icloud.com mailbox.
What to check
- ✓Devices signed in to your Apple Account: remove any you do not recognise.
- ✓iCloud Mail forwarding and rules.
- ✓Trusted phone numbers and recovery contacts or keys.
- ✓Recent emails from Apple about password changes or new sign-ins.
Check your email address for known leaks
Works with any provider. Enter your address, get a free exposure check, and see what to fix first.
Secure it
Apple accounts use two-factor authentication. Make sure trusted devices and numbers are current and that you know how to recover the account. Consider setting up a recovery contact or recovery key so you are not locked out later.
Beware of fake Apple messages
Phishing emails and texts claiming your Apple Account is locked are common. Never use links in unexpected messages. Go to the account page directly through the official site or settings on your device.
Frequently asked questions
Can an iCloud email be hacked?+
Yes, usually through reused passwords or phishing, not through weaknesses in Apple’s system itself.
Is two-factor authentication on by default?+
Apple accounts generally use it, but confirm that your trusted devices and numbers are current.
What if I got a code I did not request?+
Do not share it. Someone may be trying to sign in. Change your password and review devices.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.