Over the past week, there’s been an uptick in users reporting on Reddit and Twitter that their Instagram accounts have been hacked and the contact information associated with the account changed. After Mashable first reported on the account takeovers Monday, Instagram now says it’s looking into the claims.
“We are investigating claims of some hacked Instagram accounts and will take the necessary steps to help those impacted,” an Instagram spokesperson said in an email to VentureBeat on Tuesday, in response to questions about the account hacks detailed by Mashable. Instagram initially told Mashable that it hadn’t seen an uptick in hacks. Mashable, citing data from analytics platform Talkwalker, says there have been more than 5,000 tweets from 899 accounts mentioning Instagram hacks in the last week.
Many of the hacks reported in recent days share a few commonalities: The hackers aren’t posting anything on the accounts yet, instead immediately changing the email address and/or phone number associated with the account, as well as the user name and image. At least one user told Mashable that he was using two-factor authentication when his account was hacked, but it did nothing to stop his account from being taken over. Here’s one account from Reddit user jman7777:
On Monday morning August 6th I went to log into Instagram on my iPhone and it immediately told me my user name was not valid. I tried typing in my email address to reset my password and it said there was no valid email address by that name. I was stumped and somehow thought my Instagram account had been deleted.
I immediately re-registered my user name, using what was my original Instagram email, with the hopes that I would able to reclaim my user name/account before someone else took it.
Fast forward to lunchtime that day, I’m receiving text messages from friends are asking me what I did to my Instagram account. It was at that point that I realized my original account hadn’t been deleted at all, but rather, my user name, email address, phone number, bio and avatar were all changed by someone having a .ru email address. I immediately realized I had been hacked and filled out the submission form Instagram provides if you think your account has been hacked.
Like the account above, many users also reported that they were hacked by email accounts linked to a Russian domain name. Russian hacking activity on social media networks has been highly scrutinized, particularly since the Russia-linked Internet Research Agency was revealed to have spread misinformation on Facebook, Instagram, Twitter, and other platforms in an attempt to influence the U.S. 2016 presidential election. But it’s too early to speculate on a motive for the Instagram hacks or who is behind them. An Instagram spokesperson did not respond to a question about whether they’ve seen an uptick in accounts being hacked by email addresses ending in .ru, or whether that’s something they track.
The biggest point of frustration for affected users seems to be that they can’t reach out to Instagram directly for help, instead getting sucked into an automated help form, similar to Twitter users who were recently locked out of their accounts in a purge of potentially underage users. Additionally, users aren’t sure if they should report their original handle as the handle that’s been hacked, or the new handle that the hacker has switched it to.
Update, 8/15: Last night, Instagram published a blog post addressing the reports. Mostly, it just shares basic tips on how to keep your account secure, like using a password with at least six numbers and/or letters, and turning on 2FA. But, it does say that users who have reached out to Instagram about their accounts being taken over will hear back “soon.”
Source: VentureBeat
