The FBI this week issued a public warning that cybercriminals are hacking into social media accounts of both adults and children, stealing private photos and explicit videos, and using the content for sexual extortion, even publicly distributing it, leaving victims trapped in a cycle of repeated threats. This numbered I-081026-PSA The announcement, issued by the FBI’s Internet Crime Complaint Center (IC3) on August 10, directly targets so-called “sexual exploitation” offenders. The FBI stated that they are zeroing in on intimate images distributed without consent—namely NCII (non-consensual intimate images). Once such content is obtained, it is sold or placed on criminal marketplaces.
FBI warns: hackers are breaking into social media accounts to steal private photos, not only to extort victims but also to sell them.
The FBI says these attackers may target specific individuals they know or randomly selected targets—both can become victims. What makes it more troubling is that the stolen images are often leaked along with the victims’ personal information: name, date of birth, email, phone number, and social media usernames are all posted online alongside the stolen content, effectively exposing victims to the risk of ongoing secondary harm. Victims are not only subjected to extortion for money, but may also face harassment, sextortion, stalking, and even having the stolen content posted directly on their own social media pages, repeatedly reopening old wounds.
These stolen intimate images are often posted on criminal marketplaces along with the victims’ names, phone numbers, emails, and social media accounts—effectively bundling their personal data with private content and passing it around, serving as a starting point for harassment, stalking, and sextortion.
However, it should be pointed out that this approach of actually hacking into accounts to steal content is completely different from the common extortion emails of the past, like “I recorded you doing something shameful.” Those emails are mostly just bluffs, relying on threats to intimidate people; the attackers may not actually possess any content. But what the FBI is warning about this time is real account takeover—private images genuinely stolen, and even actually posted online.
Three Common Intrusion Methods
The FBI has observed that these criminals mostly don’t use high-tech methods—they rely on social engineering and account takeover. The common tactics identified fall into three types:
The first type is password and PIN attacks. Criminals use lists compiled from data breach websites, social platforms, or public information to launch high-frequency password attempts against social and personal accounts—commonly known as brute force—to dig out the password linked to the victim’s identity.
The second type is fake social media customer service. Attackers send messages claiming that the victim’s account is about to be suspended or locked, and ask the victim to provide a verification code to save the account. Once the victim hands over the verification code, the attacker can reset the password and take over the account directly.
The third type is phishing emails. Attackers set up fake domains and emails, impersonating social media customer service to notify users of “a new login to your account,” and attach a fake “change password” link. Once the victim clicks it, the account is theirs.
Self-Protection Tips: Follow These Steps
The FBI provided a practical self-protection checklist in its announcement:
First, don’t store sensitive images or videos on social media or other websites accessible via the internet. In plain terms, don’t put private photos on the cloud or into social media.
Second, use unique and complex passwords or PINs, enable multi-factor authentication, and don’t use information directly related to your identity, such as names of family and friends or birthdays, as passwords.
Third, be extra careful with links in emails and text messages—verify the sender’s identity and intent before replying. The FBI reminds that social media platforms typically do not proactively contact users, and anyone claiming to be a social media company’s customer service representative who suddenly asks you to resolve an account issue should raise your suspicion.
Finally, stay alert if you receive a temporary password, PIN reset, or verification code that you never requested. Never share your login information with anyone, even if they claim to be customer support for some platform. If you actually have an account issue, it’s safer to go directly to the website or official app yourself to handle it.
What should I do if I’ve been victimized?
If you suspect your intimate images have been stolen or leaked, the FBI provides a dedicated reporting channel: go to ncii.ic3.gov Report the timeline of when the content was accessed, the source of the images, the websites where they were published, and whether you subsequently experienced harassment or extortion. The FBI also urges victims to preserve relevant evidence, secure their accounts first, and then report through official channels.
Conclusion
The FBI repeatedly stresses that once intimate images are uploaded to an account accessible via the internet, every added exposure carries additional risk (best not to film them at all unless necessary—the Edison Chen case is a cautionary tale not far behind). Password management, multi-factor authentication, and staying alert to unsolicited customer service messages—these oft-repeated reminders are especially worth heeding right now, because what gets stolen isn’t just a few photos, but leverage that can hurt someone for a lifetime.
Source: KOCPC Chinese