It is agreed by all in the know that the 40 million hacked or phished iCloud accounts is bogus. There is no way that many could go un-remarked. . . even a few thousand would make headlines and that has not happened.
Even the number of “lost” iPhones and iPads being held for ransom seem to be in the low hundreds if even that.
Remember it requires the iCloud passcode be phished from an unsuspecting victim for this to work at all.
My cloud is a small black box sitting on my desk.
As much as osx tries to get me in ‘the cloud’ I’ve never done so and don’t expect to ever put my data in a server somewhere miles away.