Hackers Are Using Stolen Apple IDs to Swipe Cash in China

(Bloomberg) -- Ant Financial's Alipay and Tencent Holdings Ltd. warned that cyber-attackers employed stolen Apple IDs to break into customers' accounts and made off with an unknown amount of cash, in a rare security breach for China's top digital payments providers.

Alipay, whose parent also operates the world's largest money market fund, said on its Weibo blog that it contacted Apple and is working to get to the bottom of the breach. It warned users that've linked their Apple identities to any payment services, including Tencent's WePay, to lower transaction limits to prevent further losses. Tencent said in a separate statement it too had noticed the cyber-heist and reached out to the iPhone maker.

China's two largest companies both recommended that users of their digital wallets take steps to safeguard their Apple accounts, including by changing passwords. It's unclear how the attackers may have gotten their hands on the Apple IDs, which are required for iPhone users that buy content such as music from iTunes or the app store. Apple representatives haven't responded to requests and phone calls seeking comment.

“Since Apple hasn't resolved this issue, users who've linked their Apple ID to any payments method, including Alipay, WePay or credit cards, may be vulnerable to theft,” Alipay said in its blogpost.

Digital payments services have become a tempting target for cyber-thieves as their popularity surges around the world. Ant Financial, which is controlled by billionaire Alibaba co-founder Jack Ma, is estimated to handle more than half of China's $17 trillion in annual online payments. Formally known as Zhejiang Ant Small & Micro Financial Services Group, it leveraged Alipay's popularity to expand into everything from asset management to insurance, credit scoring and lending. It serves more than 800 million customers. Tencent's rival payments offering is a key component of the social media service WeChat, which has a billion-plus users.

Many Alipay and WePay customers that're also iPhone users link their digital wallets to their Apple IDs. Once they've gained access, online thieves can transfer cash to external accounts.

“Tencent is actively communicating with Apple to better understand how it's resolving the situation,” the WeChat-operator said in its emailed statement.

To contact Bloomberg News staff for this story: Lulu Yilun Chen in Hong Kong at ychen447@bloomberg.net;Gao Yuan in Beijing at ygao199@bloomberg.net

To contact the editors responsible for this story: Robert Fenner at rfenner@bloomberg.net, Edwin Chan

©2018 Bloomberg L.P.

With assistance from Editorial Board