Hackers are breaking into social media and personal accounts to steal intimate photos and videos, and the FBI says the stolen material can quickly become ammunition for extortion, stalking and public humiliation.
The FBI’s August 10 cybercrime alert puts a spotlight on social media hacking schemes targeting both adults and minors. According to the bureau, sexual exploitation actors are illegally accessing accounts to obtain explicit images and videos, also known as nonconsensual intimate images, before sharing the material in online communities or selling it through criminal marketplaces.
According to the FBI, the privacy violation can extend far beyond the stolen images themselves. Criminals may post a victim’s name, birthday, email address, phone number or social media username alongside the explicit material. That information can give other bad actors more ways to find and target the victim.
“Victims often face re-victimization through harassment, sextortion, stalking or other targeted attacks, such as advertising stolen content on a victim’s own social media page,” the FBI wrote in its alert.
The bureau said social media hacking can begin with information criminals already have. Attackers may make repeated attempts to access accounts using lists of passwords, PINs and personal details collected from data leaks, social media profiles and other publicly available sources. When an attacker knows who they are targeting, details such as a name or date of birth may also be used to guess login credentials.
Another method relies less on technical skill and more on convincing a person to hand over the key to their own account. According to the FBI, scammers may impersonate social media customer service representatives and send a text claiming that an account is about to be locked or disabled. The criminal then triggers a legitimate password reset and asks the victim to provide the verification code that arrives on their phone. Once the victim shares it, the attacker can take control of the account.
Phishing remains part of the playbook as well. The FBI said criminals create look alike websites and email accounts designed to resemble legitimate social media support services. A message may warn of a suspicious login and direct the target to a fake password reset page. Information entered on that page can then be captured by the attacker.
The danger surrounding social media hacking is particularly serious when minors are involved. The FBI’s broader guidance on sextortion says children and teens can be contacted through social networks, messaging services, games and other online platforms. Criminals may pretend to be another young person, offer something of value or claim they already possess compromising material before demanding more images or money.
Speaking to TechCrunch, SocialProof Security CEO Rachel Tobac said attacks targeting young boys are “a big public health issue,” pointing to cases in which victims have been driven to self harm. The FBI separately warns that financial sextortion involving minors has been linked to deaths by suicide.
Recent figures show how widespread the problem has become. According to the National Center for Missing and Exploited Children, the organization received more than 50,000 reports of financially motivated sextortion involving children and teens in 2025. That averaged 137 reports each day and rose from more than 36,000 reports in 2024. NCMEC also said offenders are increasingly moving conversations into private messaging services and encrypted apps, which can make related cases more difficult to detect.
The FBI is also paying particular attention to college athletes. In an August 10 announcement with the NCAA, the bureau said it “has determined that student-athletes are frequently targeted due to their public profiles.” According to the FBI, Name, Image and Likeness activity and an athlete’s visibility on campus or in the community can increase exposure while giving offenders more leverage when threatening to release private material.
For anyone targeted by social media hacking, the FBI recommends using unique and complex passwords or passphrases, turning on multifactor authentication and avoiding PINs or passwords based on birthdays, names or other easily discovered personal information. The bureau also advises users not to provide verification codes, temporary passwords or reset PINs to anyone who contacts them claiming to represent an online service. Account concerns should instead be handled through the platform’s official website or app.
The FBI also advises against keeping sensitive photos and videos on social media platforms or other internet accessible accounts. Anyone who discovers that intimate content has been stolen or posted without permission can report details through the FBI’s portal for nonconsensual intimate images. The bureau says victims should preserve messages and other evidence, stop communicating with offenders and avoid paying demands because payment does not reliably stop criminals from distributing the material or demanding more.
