For a couple of hours today, Apple’s developer portal was down as scattered complaints arose online that some developers’ home addresses had been changed to an address in Russia, prompting speculation that there might have been some sort of breach. The issue, which has since been resolved and according to Apple was not a security breach, was first reported by MacRumors.
A developer named David Negron, who identifies himself on Twitter as the founder of Productiontrax.com, called attention to the glitch when he tweeted that “all developer account addresses” were being shown as an address in Russia. (We’ve tried to contact Negron, to get a sense of why he wrote that “all” accounts are showing an address in Russia, but haven’t heard back.)
@apple developer account addresses are all showing an address in Russia…
— David Negron (@dave_negron) September 6, 2017
Another developer, named Kais Karim, also tweeted that he had checked four different Apple developer accounts and all showed the same address: “bul. Novatorov, Saint-Petesburg, Leningrad, 198216, Russian Federation.” Both Negron and Karim work for Quicken Loans in Detroit, Michigan, according to their online profiles; and Karim told The Verge that he noticed the erroneous Russian address was appearing in both personal and professional accounts.
It was unclear whether these bizarre address changes were due to some sort of an internal error or a hack from an outside force. The address also had a spelling error in it — “Saint-Petesburg” — which made things even murkier.
The Apple developer support team later sent out a note to developers, several hours after the problem first surfaced, to assure developers that there was “no security breach.”
“Due to a bug in our account management application, your address information was temporarily displayed incorrectly in your account details on the Apple Developer website,” the note read. “The same incorrect address was displayed to all affected developers. The underlying code-level bug was quickly resolved and your address information now shows correctly. There was no security breach and at no time were the Apple Developer website, applications, or services compromised; nor were any of your Apple Developer membership details accessed by, shared with, or displayed to anyone.”
It’s still unclear how many developers had their account addresses changed during this period. After the developer portal was down briefly for “maintenance,” it’s now back up and running.
The last major hack of the Apple developer portal, back in 2013, shut down the website for days.
Update, 11PM EST: The article has been updated to reflect that the address error appears to be revolved and to include a statement from Apple.