FBI Warns Hackers Are Breaking Into Social Media Accounts to Steal Intimate Photos for Sextortion

The FBI put out a public warning: criminals are breaking into people's social media accounts to steal intimate photos and videos, then using them for blackmail. Adults and kids both. The bureau says victims get hit twice, first the theft, then harassment, stalking, or having their own stolen images posted back on their own accounts.

According to the FBI's advisory, the attackers aren't running some exotic hack. They're using brute-force attempts with leaked or reused passwords, phishing emails that link to fake login pages, and old-fashioned impersonation, pretending to be Instagram or another platform's customer support to trick people into handing over account access.

Rachel Tobac, CEO of the security training firm SocialProof Security, told TechCrunch this kind of crime isn't new. What's notable is the FBI going public with a formal alert, which she said could mean the numbers are climbing. Tobac called it "a big public health issue," specifically flagging that young boys are a frequent target and that some victims have been driven to self-harm. The FBI did not respond to TechCrunch's request for comment on whether case numbers are actually up.

The NCAA Connection

Separately, the FBI and NCAA announced Monday they're teaming up to warn current and former college athletes about the same threat, according to Sports Illustrated. Sources familiar with the effort told SI that a significant number of NCAA athletes, both men and women, have had personal information hacked to find compromising photos, and some have been targeted with AI-generated fake sexual images built from real photos of them.

FBI section chief Dan Costin told reporters the partnership grew out of the NCAA realizing it had victims in its own ranks who needed a clear path to report crimes and connect with law enforcement. "We as a national law enforcement agency are obviously a key entity in investigating these violations," Costin said. "And they reached out to us to really develop a program where we can engage with their athletes."

The NCAA isn't investigating anything. The FBI does that. The NCAA's job is to be the pipeline, connecting universities and athletes to FBI resources and pushing prevention education. That's a meaningful distinction that separates this from a joint law-enforcement task force. It's an outreach and awareness partnership, not a criminal investigation unit.

Why Athletes and Kids Specifically

College athletes have public profiles, big followings, and name recognition, which makes them easier to find and more attractive targets for extortion since they have reputations to protect. Kids and teens are targeted for a different reason: they're less likely to recognize social engineering tactics and more likely to panic and comply when threatened, which is exactly what makes sextortion schemes work.

The FBI's advisory lays out concrete defensive steps that would stop most of these attacks before they start: unique passwords for every account, stored in a password manager instead of reused across sites, multi-factor authentication turned on everywhere, and skepticism toward anyone who reaches out unprompted claiming to be from a tech company's support team. Real companies generally don't cold-call or cold-message users about account problems. The FBI also recommends not storing intimate images in cloud-connected accounts at all, since anything stored there is only as safe as the password protecting it.

None of this requires new legislation or a tech company mandate to fix. It requires people turning on a security feature that's already sitting in their account settings.

One outlet's coverage is worth flagging for what it added that wasn't really there. A market-analysis piece from whalesbook framed the FBI advisory primarily through the lens of "regulatory scrutiny," "platform trust," and investor risk for social media companies, describing the story mainly in terms of what it means for corporate reputations and stock exposure. Nothing in the FBI's actual advisory addresses platform liability, pending regulation, or corporate financial risk. The bureau's warning is about individual account security and criminal extortion tactics, not a referendum on tech company balance sheets.

What's unresolved is the scope of the problem. Neither the FBI nor the NCAA has released numbers on how many athletes or general users have been victimized, and the FBI declined to confirm to TechCrunch whether this advisory reflects a genuine increase in cases or just a decision to publicize a long-standing threat. Anyone who suspects they've been targeted is directed to report it to the FBI's Internet Crime Complaint Center at IC3.gov.