Ugh.

Confirmed with both the hacker and Apple. It wasn’t password related. They got in via Apple tech support and some clever social engineering that let them bypass  security questions.

Years ago I played a practical joke on a friend — I hid about 20 alarm clocks in his door room, all set to go off at various hours of the night — and to get me back he broke into my dorm room and moved all my stuff across campus to an empty room. And then he locked several stray cats into my room.

But to get into my room, he didn’t jimmy the lock, he just went to the security guard and said he was me and had locked himself out. The guard let him right in.

Sounds like the human vector of attack is still the best way to get in.