Anonymous Antisec Division Dumps One Million Apple Device IDs
In September 2012, the Antisec faction of the hacktivist collective Anonymous released what it claimed were 1,000,001 unique device identifier numbers (UDIDs) belonging to Apple device users. The group alleged that the data had been extracted from a larger database of over 12 million records stored on an FBI laptop computer, raising immediate questions about why federal law enforcement would possess such a massive collection of personal device information.
The release was accompanied by a detailed statement posted to Pastebin, along with links to the encrypted data dump. Anonymous claimed the device identifiers represented only a fraction of the full database, which allegedly included usernames, device names, device types, Apple Push Notification Service tokens, zip codes, cell phone numbers, and physical addresses.
Verifying the Data Dump
While independently confirming the source of the data proved difficult, analysis of the decrypted file revealed an extensive list of 40-character hexadecimal strings consistent with the format of genuine Apple UDIDs. Each entry was paired with what appeared to be an Apple Push Notification token, a username, and a device type indicator specifying whether the UDID belonged to an iPad, iPhone, or iPod Touch.
Anonymous stated that the amount of personal information associated with each device entry varied significantly. The group claimed it deliberately stripped much of the most identifying data before publication, releasing only enough to allow individual users to check whether their devices appeared in the database.
The Alleged FBI Breach
According to the Antisec statement, the hackers exploited a Java vulnerability to access the data on an FBI Dell laptop in March 2012. The group framed the release as a form of public service auditing of federal surveillance practices, directly referencing NSA Director General Keith Alexander’s recent appearance at the Defcon hacker conference where he attempted to recruit attendees for government cybersecurity work.
The hackers characterized Alexander’s recruitment pitch as a hypocritical effort to co-opt the hacking community into serving state interests. Their response was to turn the tools of digital investigation back on the government itself.
Privacy Implications of UDID Collection
The significance of a potential government database of Apple UDIDs extended beyond simple device tracking. UDIDs functioned as persistent digital fingerprints that Apple, application developers, and advertising networks used to identify individual devices and their users across platforms and services.
Research conducted in 2011 found that 74 percent of tested iOS applications transmitted user UDIDs to remote servers. More concerning, the same researcher discovered that five out of seven social gaming networks tested allowed users to authenticate using only their UDID — meaning a stolen device identifier could function as a stolen password, granting unauthorized access to user accounts.
Apple had already begun responding to privacy concerns around UDID proliferation. Earlier in 2012, the company stopped permitting new iOS applications to access device UDIDs, acknowledging the tracking risks the identifiers posed.
Questions About Federal Device Surveillance
The core question raised by the data dump was straightforward: why would the FBI maintain a database of 12 million Apple device identifiers linked to personal user information? If authenticated, the collection would represent one of the largest known federal surveillance datasets targeting consumer electronics users.
Anonymous predicted that government damage control teams would work to discredit the release. However, given the volume of devices potentially affected, the group argued that the public had a right to know whether their personal device data was being collected and stored by federal law enforcement without their knowledge or consent.
The incident contributed to growing public awareness of government surveillance capabilities and the vulnerabilities inherent in mobile device tracking systems — issues that would continue to dominate privacy debates in the years that followed.
