The FBI is warning that cybercriminals are breaking into social media and other online accounts to steal intimate images and videos from adults and children, then using that material for extortion, harassment, and public humiliation. The bureau says the attackers often rely on social engineering rather than technical exploits alone, and that the stolen content can be used to further target victims long after the initial compromise.
How the FBI says the account thefts work
According to the FBI alert, criminals are using a mix of familiar account takeover techniques to reach private photos and videos stored in online services. The methods include brute-forcing accounts with leaked or previously used passwords, tricking people into handing over credentials, and impersonating customer support staff from companies such as Instagram and other social media platforms.
Some attackers contact targets and claim they need to help recover a locked account. Others send phishing emails that imitate login pages using fake domains designed to look legitimate. In each case, the goal is the same: get access to the victim’s account, search for intimate or explicit content, and use it to pressure the victim or profit from it.
The FBI said these crimes can escalate quickly once the attackers have a foothold. Victims are often extorted, or their stolen content is published online. In some cases, the material is used for further abuse, including stalking or repeated harassment.
What victims may face after a breach
The bureau described the fallout as more than a simple privacy violation. “Victims often face re-victimization through harassment, sextortion, stalking or other targeted attacks, such as advertising stolen content on a victim’s own social media page,” the FBI wrote.
That warning reflects a broader pattern in online abuse cases: once intimate material is taken from an account, criminals may keep using it to pressure the victim for money, silence, or more material. The FBI’s wording also suggests that attackers may be trying to humiliate victims publicly, not just demand payment privately.
Rachel Tobac, CEO of the security awareness training firm SocialProof Security, said the FBI’s public advisory could indicate the problem is increasing. Tobac said these attacks especially target young boys, and described the issue as “a big public health issue,” noting that in some cases victims are driven to self-harm in response.
Why the FBI warning matters now
Cases involving account takeovers and sextortion are not new. Criminals have used stolen credentials, phishing, and impersonation schemes for years to access private photos, messages, and cloud storage. What stands out in this case is the FBI’s decision to issue a public warning focused specifically on intimate images and videos taken from online accounts.
Public alerts from federal law enforcement often serve as a signal that a threat is widespread enough to require broader awareness. While the FBI did not respond to TechCrunch’s request for comment, the warning may reflect a pattern officials want victims, parents, and platform users to recognize before they are caught in it.
The alert also highlights a reality many users underestimate: the weakest point in account security is often not the software itself, but the person being persuaded to click, share, or reset access. Social engineering works because it exploits trust, urgency, and confusion, all of which are common when someone believes their account is at risk.
Practical steps the FBI says can help
The FBI’s advice is straightforward, but each measure addresses a common way attackers get in or stay in.
- Use unique passwords for every account, and store them in a password manager rather than reusing memorable variations.
- Turn on multi-factor authentication so stolen passwords alone are not enough to gain access.
- Be skeptical of unsolicited contact from anyone claiming to represent a social media company, since tech firms generally do not reach out unexpectedly to request account recovery steps.
- Avoid storing sensitive or intimate pictures in online accounts if you can help it, reducing the value of any account takeover.
These recommendations matter because the attacks described by the FBI are not limited to one platform or device. If attackers can guess a password, exploit reused credentials from an old breach, or convince someone to hand over login details, they may be able to reach the same content through multiple services.
Why password reuse remains a major risk
One of the most common paths into an account is still the easiest: trying passwords that were exposed in previous leaks or reused across services. If an attacker gets a working combination from one site, they may try it on social media, email, or cloud storage accounts where the same password has been used.
Password managers reduce this risk by making it practical to use a different, strong password for each account. Multi-factor authentication adds another barrier, which can stop attackers even after they have a valid password.
How to spot impersonation attempts
Fake support messages often create a sense of urgency, warning that an account is suspended, compromised, or about to be locked. The FBI’s warning suggests that users should treat those messages carefully, especially if the sender claims to work for Instagram or another platform but contacted them out of the blue.
A useful rule is to treat any unexpected request for login help, verification codes, or password resets as suspicious until confirmed through official channels. The bureau’s advice also implies that users should not assume a polished email or convincing profile means a message is genuine.
The bigger privacy lesson
Although the FBI’s warning centers on a specific form of abuse, the underlying lesson applies more broadly to digital privacy. Anything stored in an online account can become a target if that account is compromised, whether it is personal photos, private messages, documents, or backup files.
For that reason, the safest approach is to limit what sensitive material is uploaded in the first place, especially if it does not need to live in a cloud account. The less an attacker can find after breaking in, the less leverage they have to extort, threaten, or embarrass the victim.
The issue is especially serious because it can affect both adults and children. That makes the warning relevant not only to individual users, but also to families, schools, and anyone responsible for helping younger people understand account security and online exploitation.
Even when the crime starts with a stolen password, the damage often continues in the form of fear, shame, and repeated contact from attackers. The FBI’s message is that users should not wait until they see evidence of abuse to harden their accounts and rethink what they store online.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: August 12, 2026 at 1:52 am
1 views
