Apple Data Management Vulnerability Allows Ex-Employees Access to Company Files
New details reveal that former Apple employees can still access confidential company documents, even after their internal network access has been cut off.
A data management vulnerability within Apple's systems has been exposed, allowing former employees to retain access to sensitive company documents even after their employment has ended. According to The Information, several ex-employees reported they could still access shared documents and even receive notifications of file updates, despite their corporate network access being revoked.
The issue reportedly stems from Apple's long-standing practice of encouraging employees to link their personal Apple IDs with company-provided iCloud storage. Employees were offered 2TB of iCloud space, which could be merged with their existing personal storage plans. This setup resulted in some work files being stored in accounts outside of Apple's complete control.
Specifically, if documents were not placed within Apple's unified "Work" folder, former employees could continue to access them after returning company devices and leaving their positions. While Apple introduced the "Apple Work" folder to enhance control, internal files stored outside this designated area could still be mixed with personal data like photos and continue to sync.
The report also noted that before the widespread adoption of Slack around 2019, Apple heavily relied on iMessage for work communication and file sharing. While Slack access could be immediately cut off upon departure, ex-employees often retained their past iMessage chat logs and attachments. Furthermore, while departing executives' devices undergo rigorous scrutiny, ordinary employees' departures often involve less thorough reviews, increasing the risk of company files remaining on personal devices.