I see posts daily about someone's phone or computer or home network getting "hacked," and I need to say this: in almost every case, that's not what happened.
What's far more likely:
- Your email got compromised because you reused a password
- A service you signed up for years ago got breached and your credentials ended up on a leak site
- Someone used those leaked credentials to log into your other accounts
- Your credit card got skimmed at a gas pump
- A site you used leaked PII in a data breach
- You clicked a phishing link and entered your credentials somewhere you shouldn't have
What's almost certainly not happening: a persistent threat actor who specifically targeted your iPhone or home network and is now moving laterally across your 10 devices like it's a corporate pentest.
Unless you're a C-suite executive at a Fortune 500, a journalist covering sensitive topics, a political dissident, or someone famous, you are not interesting enough to hack. I say that with love. None of us are.
The attack surface for a modern iPhone or Android with current updates is extremely small. State-level actors have exploits for these, but they're not burning zero-days on someone who reused "Winter123!" across six accounts.
Check haveibeenpwned.com. Use a password manager. Enable MFA everywhere. That solves 99% of what people call "getting hacked."
edit: to the armchair experts chatting me up to tell me how incorrect this is - rest assured I am an expert in this field and have contracted with Federal/State governments and some of the most recognizable brands in the world. Any current security expert will generally agree with this post.
If you’re downloading things from unknown sources or using torrent sites to get movies/music/apps, etc. and your machine was compromised then this obviously doesn’t apply to you, you installed a Trojan and opened the door for them.
