Man sues Apple for $5 million after losing data on stolen iPhone

Man claims data loss forced his tech consulting business to shut down.

An iPhone user is suing Apple after he lost access to his entire digital life when his phone was stolen, a report by The Washington Post reveals. US man Michael Mathews claims that after his iPhone was stolen, he lost access to personal and professional data, including tax records, work-related research, family photos, and music. According to the report, Mathews argues that Apple’s account recovery system under its Advanced Data Protection (ADP) policy is flawed and left him locked out of critical data. His case has now entered its discovery phase in the U.S. District Court for the Northern District of California.

At the heart of the issue is Apple’s 28-digit Recovery Key, a core element of ADP. Image used for representative purpose only. (Bloomberg)

By Ayushmann Chawla

Ayushmann Chawla is the Deputy Chief Content Producer at Hindustan Times. A seasoned tech journalist with years of experience working for some of the industry’s leading media organizations, his articles can also be read on Live Mint. His passion extends beyond journalism—he’s a dedicated automobile enthusiast, always ready to explore the latest in car technology and design. A self-confessed gadget lover, Ayushmann finds joy in testing new devices and sharing his findings with his audience. Instagram: ayushmannchawla

Read moreRead less

Apple’s Recovery Key in Focus

At the heart of the issue is Apple’s 28-digit Recovery Key, a core element of ADP. For those who are unaware, the Recovery Key provides end-to-end encryption for iCloud data. Once enabled, Apple no longer retains access to the encryption keys, meaning only the user with the Recovery Key can recover the account.

Mathews alleges that the thief who stole his device may have used the device’s passcode to change his Apple ID password and alter the Recovery Key, effectively locking him out. Under ADP, without the correct Recovery Key, even Apple cannot help regain access.

His lawsuit seeks access to roughly 2TB of iCloud data and at least $5 million in damages, claiming the loss forced his tech consulting business to shut down.

The case raises significant questions about digital identity, data ownership, and corporate responsibility. It is worth noting that without ADP, Apple retains encryption keys that enable account recovery under strict verification. However, once ADP is enabled and a Recovery Key is created, recovery becomes solely the user’s responsibility.

Apple’s Cautious Response

While Apple declined to comment directly on the case, it expressed sympathy for victims of theft, stating, “We take all attacks on our users very seriously, no matter how rare.” The company has not indicated whether it would consider changes to ADP policies in light of the lawsuit.