Early reports seem to indicate this is not an issue with your iTunes account but in fact it is with your PayPal account. Apple has come out and stated that it was nothing to do with iTunes or security on their side and notes that this appears to be the result of a ‘phishing’ attack in which users fell for a web / email scam that provided access to users PayPal accounts.
“My iTunes account just got hacked and someone made about $700 worth of purchases. I contacted Paypal and they said Apple has gotten so many attacks since June, they can barely keep up with reporting them all.”
Apple would not comment but said that they had recently implemented new security measures.
In a statement to BBC News, Apple said: “iTunes is always working to prevent fraud and enhance the password security of all of our users.
“But if your credit card or iTunes password is stolen and used on iTunes we recommend that you contact your financial institution and inquire about cancelling the card and/or issuing a chargeback for any unauthorised transactions.
“We also recommend that you change your iTunes account password immediately.”
Apple is in spin mode now and several follow-up reports blame the users for being the subject of a run-of-the-mill phishing scam. While that may be the case (and so far these are only isolated incidents), there are still some things which don’t add up. According to the targeted customer above, in his discussions with PayPal it was clear that PayPal believed the problem was with iTunes. There is a direct billing relationship between PayPal and iTunes, and somehow that was being exploited. If it was simply that his PayPal account was compromised, then a smart scammer would spread the false charges from a variety of sources, not only iTunes. The other reported incidents seemed to follow this same pattern.
Source: BBC & TechCrunch
