"There have not been any breaches in any of Apple’s systems including iCloud and Apple ID," the spokesperson said. "The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services."

http://fortune.com/2017/03/22/apple-iphone-hacker-ransom/

This was a better comment before you "improved" it with the CVE count baloney.