Apple iCloud account practices allegedly leave some ex-employees access to confidential files

One of the theories voiced about how a former Apple employee may have accessed confidential documents after leaving the company to join OpenAI has been dispelled by a court filing. It has been suggested that access to the documents may have been inadvertent due to a seemingly messy iCloud arrangement for Apple employees – but the company says this is not the case …

Aaron “Homeboy” Tilley, reporting for The Information (paywalled without gift links, alas, but MacRumors has a summary): When new employees join Apple, the company often issues them an iPhone and Mac and pays for an iCloud account with a large amount of online storage capacity. Crucially, during the onboarding process, Apple encourages new hires to use their preexisting personal Apple IDs with this iCloud account, through which their co-workers can share internal Apple documents and other files with them. There’s a practical reason for Apple’s policy. Users of iPhones can only log into a single primary Apple ID that unlocks all iCloud capabilities at a time. Apple employees who want to maintain separate work and personal Apple IDs need to carry two iPhones with them. As a result, most Apple employees opt to use their personal Apple IDs to access their iCloud accounts, former employees said. When employees leave Apple, the company revokes access to a dedicated iCloud directory for Apple work files, as well as an authentication system for logging into other internal services, such as Slack. But former employees say the company doesn’t do a thorough job during the offboarding process of looking for confidential files that have slipped through the cracks. Because those former employees typically continue to use their personal Apple IDs with their iCloud accounts, any Apple documents stored outside workplace directories remain available to them. If you use your personal Apple ID, you get a magic “Apple Work” folder in iCloud Drive. When you leave Apple, that “Apple Work” folder disappears. But any other files or folders that were shared with you that were outside that magic folder are still in your iCloud Drive, because it’s still your personal iCloud account. Another factor that plays into this, I think, but which Tilley doesn’t address, is that your Apple ID is not an email address. Your Apple ID is an account that has one or more email addresses associated with it. Let’s say your personal iCloud account has two email addresses associated with it: example@icloud.com and example@gmail.com. Then you take a job at Apple and get the address example@apple.com. When you leave Apple, you lose access to the @apple.com address. But anything shared with your Apple ID through iCloud is still shared with you. You still have the same Apple ID account, even though you no longer have an employee @apple.com email account. Overall, this is a humane way of dealing with digital identity. Your Apple ID account is you, the person, not “example@icloud.com”, one specific unique email address. And you, the person, may well have multiple email addresses — all of which can be associated with your one Apple ID account. That makes Apple IDs more nuanced and complicated than a simple mapping of one email address = one account. And it obviously makes access restrictions more complicated. Let’s say you delete your Gmail account. Now you can’t access your old example@gmail.com email address. But your iCloud access to items shared with your Apple ID still works, even for items that were sent to your now-deleted @gmail.com address. That’s just now how “work stuff” is accessed at most companies. Tilley’s report at The Information is presented as being potentially relevant to Apple’s trade secret lawsuit against OpenAI, but Apple, in a statement to The Information, says it is not: In a statement, Apple said: “This case is about OpenAI employees wrongfully taking Apple’s secret and confidential information regarding our unreleased technologies, processes, and products. Nothing in the filing relates to documents shared by, or stored in, iCloud.” The company said it doesn’t pursue legal claims against former employees who accidentally hold on to Apple documents in their personal iCloud accounts.  ★ 

A new report from The Information details how Apple’s policy of encouraging employees to mix personal and work iCloud accounts has allowed some former staffers to retain access to confidential company files long after leaving. Here are the details.

Apple's practice of mixing employees' work files with personal iCloud accounts reportedly left some former staff with continued access to confidential documents, messages, and even new updates after leaving the company. "The former employees said many Apple files they had been shared on over their careers at the company -- including planning documents for product launch events -- continued to sync to their personal devices through the iCloud storage service after they left Apple," reports The Information. "In some cases, they even received notifications about fresh updates to the documents. Some former employees said they were petrified to delete the files for fear that doing so would attract Apple's attention." MacRumors reports: Apple files get mixed in with employees' accounts because the company encourages them to use their personal Apple Accounts with their work iCloud account. Employees are given a 2TB iCloud plan and are able to merge the storage with their existing Apple Account or create a new account. Since only one primary account can be signed in at a time, most opt to use their existing account to avoid having to carry two iPhones. Apple has a managed folder for workplace files that it revokes access to when an employee leaves, but some internal documents aren't saved there automatically and shared files end up mixed in with personal content. Employees can also retain access to iMessage chats and files shared via the Messages app. Lingering access to Apple systems is central to Apple's lawsuit against OpenAI. In its filing, Apple alleged that former employee Chang Liu breached Apple's systems using a "rare, previously unknown authentication bug" to download files while he was working at OpenAI. Apple told The Information that the OpenAI lawsuit is unrelated to any files left available on iCloud and that it does not pursue legal claims against former employees who accidentally have Apple documents in their personal iCloud accounts. "This case is about OpenAI employees wrongfully taking Apple's secret and confidential information regarding our unreleased technologies, processes, and products. Nothing in the filing relates to documents shared by, or stored in, iCloud." Read more of this story at Slashdot.

The way Apple combines work and personal iCloud accounts left some employees able to access confidential documents after departing the company, reports The Information. The site spoke to more than half a dozen former Apple employees who were unknowingly left with access to sensitive content. The former employees said many Apple files they had been shared on over their careers at the company—including planning documents for product launch events—continued to sync to their personal devices through the iCloud storage service after they left Apple. In some cases, they even received notifications about fresh updates to the documents. Some former employees said they were petrified to delete the files for fear that doing so would attract Apple's attention. Apple files get mixed in with employees' accounts because the company encourages them to use their personal Apple Accounts with their work ‌iCloud‌ account. Employees are given a 2TB ‌iCloud‌ plan and are able to merge the storage with their existing Apple Account or create a new account. Since only one primary account can be signed in at a time, most opt to use their existing account to avoid having to carry two iPhones. Apple has a managed folder for workplace files that it revokes access to when an employee leaves, but some internal documents aren't saved there automatically and shared files end up mixed in with personal content. Employees can also retain access to iMessage chats and files shared via the Messages app. Lingering access to Apple systems is central to Apple's lawsuit against OpenAI. In its filing, Apple alleged that former employee Chang Liu breached Apple's systems using a "rare, previously unknown authentication bug" to download files while he was working at OpenAI. Apple told The Information that the OpenAI lawsuit is unrelated to any files left available on ‌iCloud‌ and that it does not pursue legal claims against former employees who accidentally have Apple documents in their personal ‌iCloud‌ accounts. This case is about OpenAI employees wrongfully taking Apple's secret and confidential information regarding our unreleased technologies, processes, and products. Nothing in the filing relates to documents shared by, or stored in, iCloud. Former employees say Apple does not do a thorough enough job going through personal devices to remove sensitive files that have been stored in ‌iCloud‌. In a now-settled legal dispute, chip company Rivos claimed Apple intentionally lets former employees retain access to files "as part of a planned effort to generate a pretextual basis to sue the employees and their new employer for 'stealing' Apple material." In the Rivos case, an employee was targeted for keeping work files in his personal ‌iCloud‌ account. Another former Apple employee sued by Apple, Gerard Williams, countersued and accused the company of using intimidation tactics to scare people thinking of leaving. Apple sued Williams for breach of contract after he started processor company Nuvia, presenting extensive phone and text records of his communications. The court rejected Williams' claim, and Apple dropped the case in 2023. In 2025, Apple also accused former Vision Pro engineer Di Liu of downloading thousands of corporate documents to his personal cloud storage shortly before leaving the company for Snap. The Information does not outright suggest Apple is purposefully allowing former employees to retain access to ‌iCloud‌ files, but points out that Apple's use of ‌iCloud‌ for file sharing and its incomplete wiping of employee accounts are at odds with its heavy focus on privacy and security.Tag: Apple LawsuitsThis article, "Apple's iCloud File Sharing Left Ex-Employees With Access to Secret Documents" first appeared on MacRumors.comDiscuss this article in our forums

Apple's lawsuit against OpenAI has brought new attention to reports that some former employees retained access to confidential files through their personal iCloud accounts after leaving the company.iCloud Drive in the Files appMore than half a dozen former Apple employees told The Information that documents shared with them during their employment remained accessible after Apple cut off most of their corporate access. Some continued receiving notifications when the files were updated.The documents included confidential material such as plans for product launch events. The former employees said they made no effort to retain access and unexpectedly found the files mixed with their personal iCloud data.The problem reportedly grew from Apple's practice of encouraging employees to connect their personal Apple IDs to company-funded iCloud storage. Apple gave employees 2TB of storage and allowed them to merge it with an existing personal plan. Continue Reading on AppleInsider | Discuss on our Forums