Take a pic of your creditcard and get a call from the fraud hotline in 30 mins

The translation is a bit wierd but it's not totally Google's fault. "Map" in Icelandic also means "Card". And his name, Dagur, means Day.

But yeah, this guy takes a picture of his creditcard at 11:16 (a debit card but they all come with cc numbers as well now), because the numbers were so smudged that they were about to dissapear.

Then at 11:36, exactly 30 minutes later the local VISA company (Valitor.is) calls him. It is the emergency fraud hotline and informs him that someone in Indonesia is trying to use his card.

He used an iPhone and said the photo just went to his "Camera roll" and probably uploaded to his iCloud backup.

His card was immediately closed.

I'm confused, how did someone get into his iCloud? Or was there a MiTM?