Bear in mind this is filtered through a prosecutor, so is likely highly garbled: >"A mobile phone and hard drive were also seized and the IP address ... matche

Bear in mind this is filtered through a prosecutor, so is likely highly garbled: >"A mobile phone and hard drive were also seized and the IP address ... matched the intrusions into the organisation." This is clearly nonsense, the IP address as Apple saw it isn't likely to be anything recoverable from the devices - even if they logged past IPs, they are likely NATed. My guess is the attack involved SSH (the article mentions "authorized keys") and Apple logged the SSH fingerprint of the accessing computer.