Ikoma City: an elementary school teacher fell for smishing and their personal iCloud was briefly taken over, so images showing 41 sets of staff account IDs and passwords may have been viewed

1. 2021-04-24

   The teacher fell for phishing by an SMS posing as a parcel delivery notice, so-called smishing, and had the ID and password of Apple's iCloud, used personally, stolen. The SMS had arrived about two weeks earlier, and the teacher entered the details because no parcel came and it was on their mind. [1]

2. 2021-04-25

   The password was changed and the teacher could no longer access the account, which revealed the damage. [1]

The iCloud was synced with the teacher's private smartphone. It held images showing 41 IDs and passwords of staff Google accounts, photographed as notes, and photos of pupils, which the attacker may have accessed. The number of pupil photos was not disclosed. [1]