Loading story…
Apple left some former employees with continued access to confidential internal documents because shared files synced through personal iCloud accounts were not fully revoked during offboarding, according to reporting citing former staff. The exposed material reportedly included sensitive product launch planning documents, and in some cases updates to those files continued generating notifications on ex-employees’ personal devices after they left the company. The issue appears tied to Apple encouraging workers to use a combined personal Apple Account with work iCloud storage while not placing all internal files inside managed folders that are automatically cut off at departure.
A separate publication from OpenAI included what it described as message transcripts showing a departing Apple employee discussing copying or transferring files from an Apple iCloud account, including by AirDrop and external storage, while preserving personal notes and shared work files around the time of resignation. The messages also showed the former employee continuing to discuss Apple internal engineering and product matters with a current employee after leaving, adding to concerns about insider risk, weak access revocation, and gaps between Apple’s security posture and its controls for protecting corporate data during employee exits.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
On February 14, 2026, Apple Employee #1 asked the former employee for help recalling a technical topic, and the former employee provided guidance and suggested other Apple personnel who might know more. The transcript shows continued exchange of internal technical information after the employee's departure.
On January 31, 2026, Apple Employee #1 said they had signed out of the former employee's iCloud account and chose not to keep a copy when prompted. The former employee thanked them afterward.
On January 30, 2026, the former employee said they realized the folder was gone from their iCloud and asked whether Apple Employee #1 had obtained all needed material. They suggested contacting IST for backup if necessary.
On January 27, 2026, a participant told Apple Employee #1 they could keep the former employee's iCloud connected if more time was needed for files, while also asking them to sign out of iMessage so new company information would not appear. Apple Employee #1 said they would finish up and log everything out the next day.
Messages dated January 22-23, 2026 describe a participant copying files to a 64GB drive, restarting an AirDrop transfer, and planning to complete the transfer before clicking the Workday button. The exchange indicates efforts to move files from an Apple iCloud account around the time of departure.
Apple accused former Vision Pro engineer Di Liu of downloading thousands of corporate documents to personal cloud storage before leaving for Snap. The accusation was made in 2025.
In the Gerard Williams dispute, the court rejected Williams' claim and Apple dropped the case in 2023. The reference cites this as part of Apple's broader legal conflicts with former employees.
The Information reported that Apple's mixing of personal Apple Accounts with work iCloud storage left some former employees with continued access to confidential documents after leaving. Former employees said shared files kept syncing to personal devices and sometimes still generated update notifications.
Apple sued former employee Gerard Williams for breach of contract after he started processor company Nuvia. The dispute later featured Apple presenting extensive phone and text records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple submitted further evidence in its trade-secret lawsuit against OpenAI and former Apple employees Chang Liu and Tang Tan, alleging that Liu retained access to Apple materials after joining OpenAI in January 2026. Apple said forensic analysis of an Apple-issued MacBook found Liu downloaded a confidential circuit schematic and used it in OpenAI-related power-conversion work; the company also alleges Liu accessed Apple third-party cloud storage without authorization and instructed an OpenAI colleague to destroy evidence after learning of Apple’s internal investigation. Apple is seeking expedited discovery, damages, and an injunction barring use of its proprietary material. OpenAI denies possessing or wanting Apple’s trade secrets and has moved to dismiss the case. It argues that Apple’s use of personal iCloud accounts for work and rapid employee offboarding may have allowed former staff to retain document access without establishing intentional theft. U.S. District Judge Edward J. Davila is scheduled to hear arguments on October 1, 2026.
Sep 1, 2026
Threat actor **IntelBroker** claimed to have breached Apple and posted code on BreachForums tied to three internal tools: `AppleConnect-SSO`, `Apple-HWE-Confluence-Advanced`, and `AppleMacroPlugin`. Reporting said the exposed material appeared related to Apple’s internal authentication and workflow environment, including integrations for Atlassian Jira and Confluence, raising concern that the leak could reveal sensitive implementation details useful for follow-on attacks. Apple had not confirmed a breach at the time of reporting, and major outlets had not independently verified the claim. Independent analysis cited in coverage said the leak did **not** appear to contain the full source code for the named internal tools, but rather proprietary plugins and configuration data used to connect Apple authentication systems to internal collaboration platforms. That assessment said the exposure could still create meaningful enterprise security risk by disclosing internal architecture and access-related details, while indicating that Apple customer products and services were not affected. The claim emerged shortly after IntelBroker also alleged a breach of AMD, and later reporting noted Cisco was also claimed as a victim by the same actor.
Jun 29, 2026
Security researchers **Talal Haj Bakry** and **Tommy Mysk** disclosed that Apple’s iCloud Private Relay can be bypassed, allowing websites to learn a user’s real IP address even when Safari’s privacy feature is enabled. The researchers said the leak stems from multiple WebKit behaviors, including WebAuthn flows tied to passkeys, DNS prefetching in **iOS 26**, and **WebTransport** in **iOS 26.4**. Because the issue is rooted in WebKit, the exposure can also affect some third-party browsers on iOS, not just Safari. The researchers published a blog post and a public test site demonstrating that sites using or even imitating passkey-related prompts can trigger network requests outside Private Relay’s proxied path, exposing the device’s actual IP address and, in some cases, real DNS infrastructure without obvious user interaction. TechCrunch said it verified the leak during testing, while Apple told another outlet it is investigating the report; Private Relay remains an opt-in feature for **iCloud+** subscribers and protects Safari traffic rather than providing system-wide coverage like a VPN.
Aug 8, 2026