Sarai Hannah Ajai Formal Incident Report Regarding Verizon Orbic RC400L / Rayhunter Device-Count Irregularity After Apple iPhone 17, Verizon Account, Verizon eSIM PIN, and Apple iCloud Security Changes

 Formal Incident Report Regarding Verizon Orbic RC400L / Rayhunter Device-Count Irregularity After Apple iPhone 17, Verizon Account, Verizon eSIM PIN, and Apple iCloud Security Changes

REDACTED

Formal Incident Report Regarding Verizon Orbic RC400L / Rayhunter Device-Count Irregularity After Apple iPhone 17, Verizon Account, Verizon eSIM PIN, and Apple iCloud Security Changes

Prepared by: Sarai Hannah Ajai
Location: *****, ***** ******
Residence Reference: Apartment Unit 2**
Date of Incident: May 14, 2026
Primary Device: Apple iPhone 17
Carrier / Account: Verizon Wireless
Monitoring Device: Verizon Orbic RC400L mobile hotspot with Rayhunter environment
Wi-Fi Network Referenced: Verizon_RC400L-7E
Related Account: Apple iCloud / Apple ID account associated with Apple iPhone 17
Purpose of Report: Personal record, Verizon escalation, Apple security review, FCC/FTC complaint support, attorney review, law-enforcement review, and evidence preservation

I. Executive Summary

I, Sarai Hannah Ajai, am preparing this formal incident report to document a May 14, 2026 device-security and network-access irregularity involving my Apple iPhone 17, my Verizon wireless account, my Verizon eSIM PIN, my Apple iCloud account, and my Verizon Orbic RC400L Rayhunter device.

On May 14, 2026, I completed multiple security changes intended to secure my Apple iPhone 17, Verizon account, Verizon eSIM, and Apple iCloud account. These security actions included changing my Verizon account password and PIN, changing my Apple iPhone 17 passcode, changing my Verizon eSIM PIN, and changing the Apple iCloud account credentials associated with my Apple iPhone 17.

After these security changes were completed, I intentionally connected only my Apple iPhone 17 to the Verizon Orbic RC400L / Verizon_RC400L-7E Wi-Fi network at approximately 12:35 PM. At that time, the expected connected-device count should have been one device, meaning my Apple iPhone 17 only. However, the Verizon Orbic RC400L screen appeared to display a connected-device indicator showing 2 devices.

This report does not state as a final forensic conclusion that the second device was definitely a cloned, mirrored, or unauthorized Apple iPhone 17. Instead, this report documents the observed discrepancy, the sequence and timing of the security changes, the fact that I had not left Apartment Unit 2** since the prior day, the fact that I had not communicated with any person from my Apple iPhone 17, and the photographic exhibits supporting the incident record.

The strongest careful conclusion is:

At approximately 12:35 PM on May 14, 2026, after I had already changed my Verizon account password/PIN, Apple iPhone 17 passcode, Verizon eSIM PIN, and Apple iCloud account credentials, I intentionally connected only my Apple iPhone 17 to the Verizon Orbic RC400L / Verizon_RC400L-7E Wi-Fi network. The expected connected-device count was one device. However, the Verizon Orbic RC400L screen appeared to display a connected-device indicator showing 2 devices. This discrepancy should be preserved as a suspected device-association irregularity requiring review of Orbic connected-client records, Apple private Wi-Fi address behavior, Verizon account/eSIM records, Apple iCloud trusted-device records, and possible active or stale Wi-Fi client entries.

II. Background and Prior-Day Context

This May 14, 2026 incident occurred after prior access-control and device-security concerns involving my apartment, Apple iPhone 17, Verizon account, and Verizon Orbic RC400L / Rayhunter environment.

Exhibit A is a screenshot of smart-lock activity logs for May 13, 2026. The screenshot includes annotations stating that I left Apartment Unit 2** at approximately 3:56 PM to go to Walmart for grocery items and returned at approximately 9:10 PM. The same exhibit shows activity involving the “Kitchen Door Entrance,” including entries associated with Remote, Keypad, App, and Alexa.

According to the visible and annotated timeline in Exhibit A:

1. I left Apartment Unit 2** at approximately 3:56 PM on May 13, 2026.
2. I returned at approximately 9:10 PM.
3. After returning, I noticed the SwitchBot lock appeared jammed.
4. I changed the battery.
5. I restarted or reset the SwitchBot lock device.
6. I recalibrated the front-door / Apartment 2** SwitchBot device.
7. I tested an Alexa voice command to lock the front door.

This prior-day context is relevant because it supports my apartment-access timeline and provides background for my statement that, by the time of the May 14 incident, I had not left my residential apartment unit, 2**, since the prior day.

For the May 14 incident, I state that I had not communicated with any person from my Apple iPhone 17 and had not left Apartment Unit 2** before the Verizon Orbic RC400L displayed the unexpected connected-device count at approximately 12:35 PM.

III. Devices, Accounts, and Security Items Involved

A. Apple iPhone 17

The Apple iPhone 17 is my known and authorized personal device. It is the only device I intentionally connected to the Verizon Orbic RC400L Wi-Fi network at approximately 12:35 PM on May 14, 2026.

B. Verizon Account Password and PIN

At approximately 11:28 AM, I changed the password and PIN associated with my Verizon account connected to my Apple iPhone 17.

This security change occurred approximately 67 minutes before the 12:35 PM Verizon Orbic RC400L device-count discrepancy.

C. Apple iPhone 17 Passcode

At approximately 11:31 AM, I changed my Apple iPhone 17 device passcode.

This security change occurred approximately 64 minutes before the 12:35 PM Verizon Orbic RC400L device-count discrepancy.

D. Verizon eSIM PIN

At approximately 11:33 AM, I changed my Verizon eSIM PIN.

This security change occurred approximately 62 minutes before the 12:35 PM Verizon Orbic RC400L device-count discrepancy.

E. Apple iCloud Account Associated With Apple iPhone 17

At approximately 11:43 AM, I changed the Apple iCloud account credentials associated with my Apple iPhone 17.

This security change occurred approximately 52 minutes before the 12:35 PM Verizon Orbic RC400L device-count discrepancy.

F. Verizon Orbic RC400L / Rayhunter Device

At approximately 12:35 PM, I connected my Apple iPhone 17 to the Verizon Orbic RC400L / Verizon_RC400L-7E Wi-Fi network.

The expected connected-device count was:

1 connected device — my Apple iPhone 17 only.

The Verizon Orbic RC400L screen appeared to display:

2 connected devices, or a connected-device indicator showing 2.

IV. Corrected Minute-by-Minute Timing Analysis

The timing is important because the Verizon Orbic RC400L displayed the unexpected device count after all four security changes had already been completed.

Timing Interpretation

The corrected timeline shows that the Verizon Orbic RC400L device-count irregularity occurred at approximately 12:35 PM, after all four security changes had already been completed.

The Verizon account password/PIN change occurred approximately 67 minutes before the Orbic event. The Apple iPhone 17 passcode change occurred approximately 64 minutes before the Orbic event. The Verizon eSIM PIN change occurred approximately 62 minutes before the Orbic event. The Apple iCloud account credential change occurred approximately 52 minutes before the Orbic event.

Therefore, the 12:35 PM Orbic display showing 2 connected devices occurred after the Verizon account, iPhone passcode, Verizon eSIM PIN, and Apple iCloud account security changes had already been completed.

This sequence is significant because I had already taken multiple security steps before connecting the Apple iPhone 17 to the Verizon Orbic RC400L Wi-Fi network. Despite those security steps, the Orbic display appeared to show 2 connected devices when only 1 connected device was expected.

V. Description of the May 14 Device-Count Irregularity

After completing the Verizon account password/PIN change, Apple iPhone 17 passcode change, Verizon eSIM PIN change, and Apple iCloud account credential change, I intentionally connected my Apple iPhone 17 to the Verizon Orbic RC400L Wi-Fi network.

The expected result was:

One connected device: my Apple iPhone 17.

However, the Verizon Orbic RC400L screen appeared to show:

Two connected devices, or a connected-device indicator displaying 2.

This is significant because I had not knowingly connected any second device to the Verizon Orbic RC400L at that time. I had not communicated with any person from my Apple iPhone 17, and I had not left Apartment Unit 2** since the prior day.

The discrepancy should be preserved because it may indicate one of several possible conditions, including:

1. unknown second Wi-Fi client;
2. stale connected-device record;
3. prior DHCP lease still appearing on the device;
4. Apple Private Wi-Fi Address behavior;
5. duplicate Apple iPhone 17 device-name entry;
6. Verizon Orbic display delay or interface issue;
7. unauthorized Wi-Fi association;
8. device mirroring or cloning indicator;
9. Apple iCloud / Apple ID account irregularity;
10. Verizon account, eSIM, SIM, or device-authentication irregularity.

This report does not determine which explanation is correct. It preserves the event for review.

VI. Exhibit A — May 13 Smart-Lock / Apartment Access-Control Log

Exhibit A is a screenshot labeled “Logs” for May 13. It shows smart-lock activity for “Kitchen Door Entrance” and includes annotations describing the prior-day access timeline.

The visible and annotated items include:

1. leaving Apartment Unit 2** at approximately 3:56 PM for Walmart grocery items;
2. a lock entry at approximately 4:01 PM by Keypad;
3. an unlock entry at approximately 9:03 PM by Remote;
4. return to Apartment Unit 2** at approximately 9:10 PM;
5. a lock entry at approximately 9:10 PM by App;
6. a restart entry at approximately 9:21 PM;
7. recalibration at approximately 9:23 PM;
8. lock/unlock activity at approximately 9:24 PM and 9:25 PM;
9. testing an Alexa voice command to lock the front door at approximately 9:25 PM.

Exhibit A Relevance

Exhibit A supports the apartment-access timeline and provides context for my statement that I had not left Apartment Unit 2** after returning the prior day. It also documents that I was actively securing or recalibrating my apartment access-control device before the May 14 Verizon Orbic RC400L device-count irregularity.

Exhibit A does not prove the cause of the May 14 connected-device count. It is included as timeline and access-control context.

VII. Exhibit B — Verizon Orbic RC400L Screen Showing Device Indicator

Exhibit B is a photograph of the Verizon Orbic RC400L screen. The screen appears to show the Device Info menu. The screen also appears to show a connected-device-style icon with a visible indicator displaying 2.

Exhibit B Relevance

Exhibit B is relevant because it captures the apparent device-count condition shortly after I connected my Apple iPhone 17 to the Verizon_RC400L-7E Wi-Fi network at approximately 12:35 PM.

The expected count was:

1 connected device.

The photographed screen appeared to show:

2 connected devices or a connected-device indicator displaying 2.

This difference is the central technical irregularity in the May 14 incident.

Exhibit B Limitation

Exhibit B should be interpreted carefully. It appears to show a count indicator, but a complete technical determination would require additional records, including:

1. Verizon Orbic admin connected-client list;
2. device names;
3. IP addresses;
4. MAC addresses or Apple private Wi-Fi addresses;
5. DHCP lease times;
6. timestamps;
7. whether the second entry remained after disconnecting the known Apple iPhone 17;
8. whether the count changed after rebooting the Orbic;
9. whether the count changed after changing the Orbic Wi-Fi password;
10. whether any Rayhunter logs align with the same time period.

VIII. Technical Interpretation of the Security-Change Sequence

The May 14 sequence is important because the unexpected connected-device count appeared after multiple security actions.

The corrected sequence was:

1. Verizon account password/PIN changed at approximately 11:28 AM.
2. Apple iPhone 17 passcode changed at approximately 11:31 AM.
3. Verizon eSIM PIN changed at approximately 11:33 AM.
4. Apple iCloud account credentials changed at approximately 11:43 AM.
5. Apple iPhone 17 connected to Verizon Orbic RC400L at approximately 12:35 PM.
6. Verizon Orbic RC400L appeared to display 2 devices instead of 1.

The first four changes occurred before the Orbic event and were intended to secure the Verizon account, iPhone device access, eSIM environment, and Apple iCloud account.

What the Timing Supports

The timing supports these careful statements:

1. The Verizon Orbic device-count discrepancy appeared after Verizon account, iPhone passcode, eSIM PIN, and iCloud account security changes.
2. The expected count at 12:35 PM was one connected device.
3. The observed count appeared to be two connected devices.
4. I had not knowingly connected a second device.
5. I had not left Apartment Unit 205 since the prior day.
6. I had not communicated with any person from my Apple iPhone 17 before the 12:35 PM observation.
7. The discrepancy is significant enough to preserve and request review.

What the Timing Does Not Yet Prove

The timing does not yet prove:

1. that a second physical device was definitely present;
2. that the second entry was definitely a cloned iPhone;
3. that the second entry was definitely a mirrored iPhone;
4. that a specific person accessed the Verizon Orbic RC400L;
5. that Verizon account compromise definitely occurred;
6. that Apple iCloud account compromise definitely occurred;
7. that eSIM compromise definitely occurred;
8. that the Orbic screen did not display stale or cached information.

IX. Relationship to Apple iCloud Security Change at 11:43 AM

The Apple iCloud account credential change at approximately 11:43 AM is important because it occurred before the Verizon Orbic RC400L displayed the unexpected connected-device count at approximately 12:35 PM.

The Apple iCloud credential change occurred approximately 52 minutes before the Orbic event. Therefore, the 12:35 PM device-count discrepancy occurred after the Apple iCloud account had already been changed as part of the security-hardening sequence.

The proper interpretation is:

The Apple iCloud account credential change at approximately 11:43 AM occurred 52 minutes before the Verizon Orbic RC400L displayed the unexpected connected-device count at approximately 12:35 PM. Therefore, the 12:35 PM discrepancy occurred after the Apple iCloud account had already been changed as part of the security-hardening sequence.

This makes the iCloud change part of the pre-event security timeline rather than a follow-up action.

X. Relationship to Prior Find My and Location Concerns

This May 14 incident should also be reviewed in relation to prior Find My and location irregularities involving my Apple iPhone 17.

A prior Find My screenshot showed a blue estimated location dot near the apartment building or exterior area. That prior location evidence was treated only as a general location estimate, not as proof of an exact indoor location.

The careful prior conclusion remains:

Based on the Find My app screenshot, the blue dot appeared to represent a general estimated location near the apartment building or exterior area, rather than a confirmed location inside Apartment Unit 2**. Because Find My location dots are approximate and can vary based on GPS, Wi-Fi, cellular, and indoor-location limitations, the screenshot should be treated only as a general location estimate. Based on that estimate, the screenshot did not specifically place the suspected device inside Unit 2**.

The May 14 Orbic device-count discrepancy is separate from the Find My location issue, but both incidents relate to the broader concern that an unexpected device, duplicate device identity, Apple account irregularity, or Verizon/eSIM irregularity may exist.

XI. Possible Technical Explanations Requiring Review

The May 14 device-count discrepancy may have multiple possible explanations.

1. Stale Verizon Orbic Client Entry

The Orbic may have retained a previously connected client entry and continued to display it temporarily.

2. DHCP Lease Retention

The Orbic may have counted a prior DHCP lease even though the device was no longer actively connected.

3. Apple Private Wi-Fi Address Behavior

Apple devices can use private Wi-Fi addresses. If the Apple iPhone 17 changed or reused Wi-Fi identifiers, the Orbic may have displayed more than one client-like entry.

4. Duplicate Device Name

The Orbic interface may have displayed more than one iPhone-labeled or Apple-device entry if device names were duplicated or cached.

5. Orbic Interface Delay

The physical screen may have shown delayed or cached information rather than live active-client data.

6. Unknown Active Wi-Fi Client

An unknown device may have been connected to the Verizon_RC400L-7E Wi-Fi network at the same time.

7. Unauthorized Wi-Fi Association

If the Orbic Wi-Fi password was known or exposed, an unauthorized device may have connected.

8. Device Mirroring or Cloning Indicator

If additional evidence shows duplicate identifiers, overlapping sessions, unknown trusted devices, repeated connection activity, or unknown Verizon/Apple account events, the discrepancy may support a suspected mirroring or cloning concern.

9. Verizon Account or eSIM Irregularity

If Verizon records show unknown IMEI, IMEI2, ICCID, EID, eSIM, provisioning, or line-authentication events, the device-count discrepancy may be relevant to Verizon account-security review.

10. Apple iCloud / Apple ID Irregularity

If Apple records show unknown trusted devices, unexpected Apple ID sessions, Find My anomalies, or unauthorized iCloud access, the discrepancy may be relevant to Apple account-security review.

XII. Evidence Preservation Statement

I am preserving Exhibit A and Exhibit B, along with the May 14 security-change timeline.

Preserved Evidence Includes

1. Exhibit A: May 13 smart-lock / apartment access-control log screenshot.
2. Exhibit B: May 14 Verizon Orbic RC400L screen photograph showing apparent connected-device indicator displaying 2.
3. Notes documenting Verizon account password/PIN change at approximately 11:28 AM.
4. Notes documenting Apple iPhone 17 passcode change at approximately 11:31 AM.
5. Notes documenting Verizon eSIM PIN change at approximately 11:33 AM.
6. Notes documenting Apple iCloud account credential change at approximately 11:43 AM.
7. Notes documenting Apple iPhone 17 connection to Verizon Orbic RC400L at approximately 12:35 PM.
8. Notes documenting that only one device was expected to be connected at 12:35 PM.
9. Notes documenting that I had not left Apartment Unit 2** since the prior day.
10. Notes documenting that I had not communicated with any person from my Apple iPhone 17 before the 12:35 PM observation.

XIII. Requested Verizon Review

I request that Verizon review the following:

1. whether any unknown IMEI, IMEI2, ICCID, EID, or eSIM profile was associated with my Verizon line;
2. whether any SIM/eSIM download, transfer, reactivation, refresh, or reprovisioning occurred;
3. whether any account-access event occurred on or around May 14, 2026;
4. whether the Verizon account password/PIN change at approximately 11:28 AM was processed correctly;
5. whether the Verizon eSIM PIN change at approximately 11:33 AM was processed correctly;
6. whether any port-out, transfer PIN, account lock, customer-care, or in-store account event occurred;
7. whether the Verizon Orbic RC400L can produce a connected-client list for approximately 12:35 PM;
8. whether the Orbic connected-device indicator reflects active clients only or also stale/cached clients;
9. whether Verizon_RC400L-7E had any unknown Wi-Fi client associated at approximately 12:35 PM;
10. whether device-count data, DHCP leases, IP addresses, or administrative records can confirm the identity of the second device;
11. whether Verizon can confirm that account takeover protection, number lock, port protection, SIM/eSIM protections, and account PIN protections are active.

XIV. Requested Apple Review

I request that Apple or a qualified Apple security reviewer evaluate:

1. Apple ID / iCloud trusted-device list;
2. unknown Apple ID sessions;
3. Find My device list and location records;
4. Apple iPhone 17 device name and device identifiers;
5. Apple iPhone 17 passcode-change timeline;
6. Apple iCloud account credential-change timeline at approximately 11:43 AM;
7. Wi-Fi private address behavior for Verizon_RC400L-7E;
8. whether an Apple Private Wi-Fi Address change could produce multiple apparent device records;
9. configuration profiles;
10. VPN settings;
11. device management status;
12. certificates;
13. whether any unknown device, browser, or session accessed the Apple iCloud account;
14. whether a duplicate iPhone 17-labeled entry could appear from ordinary Apple privacy behavior or from an abnormal account/device condition.

XV. Recommended Follow-Up Evidence Steps

To strengthen the record, I should continue documenting this issue in a controlled way:

1. Take a screenshot of the Orbic admin connected-client list, not only the physical screen.
2. Record each connected device name.
3. Record each IP address.
4. Record each MAC address or Apple private Wi-Fi address, if visible.
5. Disconnect the Apple iPhone 17 from Verizon_RC400L-7E.
6. Check whether the Orbic count changes from 2 to 1 or from 2 to 0.
7. Reconnect the Apple iPhone 17 and document whether the count becomes 1 or 2.
8. Reboot the Orbic and document the count before and after.
9. Change the Orbic Wi-Fi password and document whether the second count remains.
10. Check whether the Orbic shows active clients separately from stored clients.
11. Preserve any Rayhunter captures from the same time window.
12. Preserve Verizon security-change confirmation emails or messages.
13. Preserve Apple iCloud security-change confirmation emails or messages.
14. Preserve Apple ID trusted-device screenshots.
15. Preserve all screenshots with timestamps.
16. Avoid deleting device logs, Orbic records, Apple security messages, Verizon notices, or Rayhunter capture files.

XVI. Formal Incident Statement

I did not knowingly authorize a second device to connect to the Verizon Orbic RC400L Wi-Fi network at approximately 12:35 PM on May 14, 2026.

At that time, my expected connected-device count was one, because I had intentionally connected only my Apple iPhone 17.

Before the 12:35 PM connection event, I had already changed my Verizon account password/PIN, Apple iPhone 17 passcode, Verizon eSIM PIN, and Apple iCloud account credentials.

I had not left Apartment Unit 2** since the prior day, and I had not communicated with any person from my Apple iPhone 17 before the 12:35 PM observation.

I did not authorize any person to mirror, clone, duplicate, access, control, monitor, intercept, or interfere with my Apple iPhone 17, Verizon account, Verizon eSIM, Apple iCloud account, Verizon Orbic RC400L, Verizon_RC400L-7E Wi-Fi network, Apple ID, or related electronic communications.

XVII. Final Technical Conclusion

The May 14, 2026 evidence supports a serious device-count discrepancy requiring review.

The most accurate conclusion is:

At approximately 12:35 PM on May 14, 2026, after I completed Verizon account password/PIN, Apple iPhone 17 passcode, Verizon eSIM PIN, and Apple iCloud account security changes, I intentionally connected only my Apple iPhone 17 to the Verizon Orbic RC400L Wi-Fi network. The Verizon Orbic RC400L screen appeared to display a connected-device indicator showing 2 devices, although only one device was expected. The evidence does not yet prove cloning or mirroring, but it warrants further review of Orbic connected-client records, Apple private Wi-Fi address behavior, Verizon account/eSIM records, Apple iCloud trusted-device records, and any active or stale Wi-Fi client entries.

XVIII. Exhibit List

Exhibit A — May 13 Smart-Lock / Apartment Access-Control Log

Screenshot showing May 13 smart-lock activity for the “Kitchen Door Entrance,” including lock/unlock, restart, recalibration, app, remote, keypad, and Alexa entries, with annotations regarding the Walmart trip, return to Apartment Unit 2**, SwitchBot lock issue, battery change, reset/restart, recalibration, and Alexa test.

Exhibit B — May 14 Verizon Orbic RC400L Screen Photograph

Photograph of the Verizon Orbic RC400L screen showing the Device Info menu and an apparent connected-device indicator displaying 2, shortly after I connected my Apple iPhone 17 to the Verizon_RC400L-7E Wi-Fi network at approximately 12:35 PM.

Exhibit C — May 14 Security-Change Timeline

Written timeline documenting:

• Verizon account password/PIN changed at approximately 11:28 AM;
• Apple iPhone 17 passcode changed at approximately 11:31 AM;
• Verizon eSIM PIN changed at approximately 11:33 AM;
• Apple iCloud account credentials changed at approximately 11:43 AM;
• Apple iPhone 17 connected to Verizon Orbic RC400L at approximately 12:35 PM.

Exhibit D — Corrected Minute Comparison Analysis

Written analysis showing that the 12:35 PM Orbic event occurred:

• 67 minutes after Verizon password/PIN change;
• 64 minutes after Apple iPhone 17 passcode change;
• 62 minutes after Verizon eSIM PIN change;
• 52 minutes after Apple iCloud account credential change.

XIX. Closing Statement

This report is prepared to preserve my observations, screenshots, photographs, security-change timeline, corrected timing analysis, and technical concerns in a clear written record.

The May 14 device-count discrepancy is not being presented as final forensic proof of device cloning or mirroring. It is being preserved as a significant irregularity because it appeared after multiple security changes and after I intentionally connected only one device, my Apple iPhone 17, to the Verizon Orbic RC400L Wi-Fi network.

This matter should be reviewed by Verizon, Apple, or a qualified technical reviewer to determine whether the second count was caused by a stale client record, private Wi-Fi address behavior, a router display condition, an unauthorized Wi-Fi client, account compromise, eSIM irregularity, Apple iCloud irregularity, or another device-authentication issue.

Respectfully submitted,

Sarai Hannah Ajai
*****, ***** ******
Date: May 14, 2026