The FBI has issued a public alert warning that hackers are systematically breaching social media accounts — belonging to both adults and children — to steal explicit content. The stolen material is then sold on criminal marketplaces, often bundled with the victim's personal information, enabling ongoing re-victimization through harassment, sextortion, stalking, and targeted attacks. In some cases, stolen content is advertised back to victims directly on their own social media pages.
How the Attacks Work
The FBI identified several distinct attack methods depending on the target and the attacker's prior knowledge:
Credential stuffing from breached data — Attackers use leaked passwords and PINs sourced from data breach sites to gain direct account access. Victims who reuse passwords across platforms are at highest risk.
Password guessing against acquaintances — When targeting known individuals, attackers try password variations based on birthdates, names, or other personal details they already possess.
Platform impersonation — Threat actors impersonate social media representatives, claiming the victim's account has been compromised. Victims are then "message bombed" with texts requesting password resets or verification codes, which enable account takeover.
Cloned phishing sites — Fake versions of social media login pages capture credentials in real time, forwarding them directly to the attacker.
Who Is Being Targeted
Both adults and children are targeted. Victims include random targets of opportunity and known acquaintances of the attackers. The combination of personal information bundled with explicit content creates compounding harm — victims face not just exposure, but ongoing targeted abuse campaigns.
Real-World Cases
The scale of individual attacks underscores the severity of the threat:
- An Illinois man (27) pleaded guilty in February after hacking approximately 600 women's Snapchat accounts to steal explicit content.
- A former University of Michigan assistant coach was indicted for accessing the medical records of approximately 150,000 students across more than 100 universities, using that information to breach female athletes' social media accounts.
Snapchat is specifically mentioned in connection with high-profile cases, though the advisory covers social media platforms broadly.
How to Protect Yourself
The FBI's advisory implicitly points to the attack vectors as the defensive roadmap:
- Use unique passwords for every account — avoid personal information like birthdates or names
- Enable multi-factor authentication on all social media accounts to block credential-based takeovers
- Be skeptical of unsolicited messages claiming to be from platforms requesting resets or verification codes — legitimate platforms don't operate this way
- Verify login page URLs carefully before entering credentials — cloned sites are designed to look identical to the real thing
- Do not respond to message bombing with verification codes under pressure
The advisory reinforces that social engineering remains one of the most effective attack vectors precisely because it bypasses technical controls by manipulating human behavior. No amount of platform security protects an account when the user hands over the credentials directly.