The FBI rarely issues public alerts unless something is getting worse. That’s worth keeping in mind as the bureau warned that cybercriminals are actively breaking into social media accounts to steal intimate images and videos, then using that content to extort, harass, or publicly humiliate their victims.
The tactics involved are not new, but the FBI’s decision to go public suggests the scale is growing. Attackers use brute-force logins with leaked passwords, fake customer service impersonations posing as Instagram staff, phishing emails with fake login pages, and social engineering to trick targets into handing over access. Once inside, the damage can be severe. The bureau noted that stolen content is sometimes posted directly to a victim’s own social media profile.
Rachel Tobac, CEO of security awareness firm SocialProof Security, told TechCrunch these attacks disproportionately hit young boys and called it “a big public health issue,” pointing to cases where victims were driven to self-harm. The FBI also specifically flagged student-athletes as frequent targets because of their public profiles.
So what can you actually do? The FBI’s own advice is practical:
- Use unique passwords stored in a password manager
- Turn on multi-factor authentication everywhere
- Be suspicious of anyone claiming to work for a social media company who contacts you out of nowhere
- Avoid storing intimate images in any online account
That last point is blunt but honest. No account is fully secure. And tech companies, for the record, do not cold-contact users asking to “recover” their account. If someone reaches out saying they do, it’s an attack. Full stop.