FBI warns hackers steal intimate images for extortion

The bureau says attackers use fake support messages, phishing, and reused passwords to access social media accounts and weaponize private photos.

The FBI is warning that cybercriminals are breaking into social media accounts to steal intimate photos and videos from both adults and children. The bureau says the stolen material is then used to extort victims, harass them, or post the content online. That makes the harm far more serious than a typical account takeover. For many victims, the fallout can continue long after the initial breach.

The alert draws attention to a crime that has existed for years but may now be surfacing more prominently. It also underscores a particularly damaging side of account hacking: the breach itself is only the start. Victims can face repeated harassment, stalking, and what the FBI describes as re-victimization.

Social engineering drives many of the account break-ins

According to the FBI, attackers often rely on social engineering — tricking people into giving up access rather than exploiting technical flaws alone. The bureau said the methods include brute-forcing accounts with leaked or previously used passwords, impersonating customer service representatives from Instagram and other social media companies, and sending phishing emails that lead to fake login pages.

In some cases, criminals contact targets and claim they are helping recover the victim’s account. That kind of deception can be hard to spot, especially when the message appears to come from a familiar platform.

The FBI said these tactics are being used to gain access to online accounts where private images or videos are stored. Once inside, attackers can copy that material and use it as leverage against the victim.

The FBI says student-athletes are frequent targets

When asked for comment, the FBI referred TechCrunch to a press release saying it had determined that student-athletes are frequently targeted because of their public profiles.

That gives the warning a more specific human angle. Public visibility can make some people easier to identify and approach, even if they are not public figures in the usual sense. As IT-PUB News notes, the bureau’s warning suggests attackers are not choosing victims at random, but looking for people whose online presence may make them easier to pressure.

Rachel Tobac, CEO of the security awareness training company SocialProof Security, said the attacks especially target young boys. She also called the issue “a big public health issue,” saying that in some cases victims are driven to self-harm in response.

The FBI alert itself does not go that far. Still, it shows how serious the consequences can be when private images are stolen and then weaponized. The harm is not only digital — it can affect a person’s safety, mental health, and willingness to stay active online.

The warning points to risks beyond a single hacked account

Tobac said the FBI’s public alert may also signal that these incidents are rising. The bureau did not say in the text provided that the attacks are increasing, but its decision to issue a public warning suggests the issue has become serious enough to address more broadly.

That matters because the attack chain is simple enough to affect ordinary users, not just high-profile targets. Anyone who reuses passwords, responds to fake support messages, or stores private images in online accounts can be vulnerable.

The consequences can be severe even if the attacker does not immediately publish the stolen material. The threat of exposure alone can be used as pressure in sextortion schemes. If the content is shared, the victim may also face further harassment on social media, including posts made from the victim’s own page.

The FBI’s advice centers on basic account protection

The bureau’s guidance is straightforward. It urges people to use unique passwords stored in a password manager, enable multi-factor authentication, and be cautious if someone unexpectedly claims to work for a social media company.

The FBI also said people should avoid storing intimate pictures in online accounts. That advice reflects the core risk in these cases: once private material is accessible through a compromised account, it can be copied and used in ways that are hard to undo.

The warning is a reminder that account security is not just about protecting a login. For many people, it is also about protecting privacy and stopping deeply personal images from being turned into tools of abuse. As social media remains central to everyday communication, even a simple account compromise can quickly become a much larger personal and social problem.