Apple customers may have been exposed to yet another security breach, an expert claims.
Experts believe a now-resolved iCloud bug allowed complete strangers to read the notes stored on another person’s iPhone.
Worse still, the flaw was allegedly hushed-up by bosses in California, who discreetly fixed the issue before it became public knowledge.
The news comes just days after it was revealed that a FaceTime glitch allowed the video-calling software to eavesdrop on users.
According to a report in The Hacker News, the breach happened late last year.
Identified by Turkish researcher Melih Sevim, it apparently allowed him to ‘view partial data, especially notes, from random iCloud accounts as well as on targeted iCloud users just by knowing their associated phone numbers.’
He reported it to Apple’s security team in November, who ‘acknowledged the issue but responded that the company had already addressed it before receiving details from him.’
Apple then apparently closed the ticket without choosing to alert its millions of users, it’s reported.
In addition, Sevim also claims the company failed to pay him a reward as part of their ‘Bug Bounty’ reporting scheme.
‘Apple responded [quickly] – we were in frequent communication with them until they fix the flaw,’ he told The Sun.
‘After their job is done and the flaw is fixed, they stopped the conversation and stopped messaging back to me. Also they didn’t give my bounty.’
MailOnline have contacted Apple for comment but are yet to receive a response.
Earlier last week, a Houston lawyer filed a lawsuit against Apple over the FaceTime security flaw, which was discovered by Grant Thompson, a 14-year-old high school student in Tucson, who was trying to play Fortnite with his friends.
The issue appeared to stem from the ‘add person’ function, confusing it into activating the call recipient’s microphone even before the call is accepted.
The lawsuit was filed on Monday by attorney Larry Williams in Harris County, Texas.
In it, Williams claims that Apple ‘failed to exercise reasonable care’ and that the company ‘knew, or should have known, that its product would cause unsolicited privacy breaches and eavesdropping.’