FBI warns criminals are hunting nude photos in hacked accounts
The bureau says attackers are breaking into social media and cloud accounts to steal intimate images, then using them for blackmail, resale on criminal sites, and follow-on sextortion attacks against victims and their families.
Key points
- The FBI issued a public warning this week that criminals are breaking into online accounts specifically to steal sexually explicit photos and videos of adults and children.
- Stolen images are being resold on criminal marketplaces along with victims' names, dates of birth, phone numbers and social media handles.
- The FBI and the National Collegiate Athletic Association (NCAA) issued a joint warning the same day that college student-athletes are being targeted in the same schemes.
- Common lures include fake text messages demanding a verification code and fake password-reset emails.
- In May, a Canadian man was sentenced to 33 years in prison for a sextortion scheme that targeted more than 145 children in the United States.
The FBI has a blunt message for anyone with a phone: criminals are now hunting inside people's accounts for nude photos and videos, and the fallout does not stop at the theft.
In a public service announcement this week, first reported by BleepingComputer, the bureau said attackers are breaking into social media, email and cloud storage accounts to pull out intimate images. They then use those images to blackmail the victim, sell them on criminal websites, or hand them off to other criminals who keep the pressure going.
That follow-on pressure has a name. It is called sextortion, a form of online blackmail where a criminal threatens to publish nude images unless the victim pays money or sends more explicit content.
How are the criminals getting in?
Mostly by tricking people into handing over the keys. The FBI says the two most common lures right now are fake text messages claiming an account will be shut down unless you enter a verification code, and fake emails saying someone just logged in and you need to click a link to reset your password.
Both are phishing, meaning messages designed to look real so you type your password or one-time code into a site the criminal controls.
The bureau's guidance is simple. A real company will never phone, text or email asking you to read back a verification code or a PIN reset code. If a message asks for one, it is a scam.
Who is being targeted?
Everyone with an account, but the FBI called out two groups specifically. Children are being targeted through the platforms they already use. And on the same day as the main alert, the FBI and the NCAA, the body that runs U.S. college sports, issued a joint warning that student-athletes are being singled out.
Coaches, compliance staff and athletic departments were asked to warn their players directly.
What happens after the images are stolen?
The images do not just sit in one criminal's hands. "Once the sexually explicit content is stolen, SE actors post or sell it to criminal marketplaces, which often includes personal information about the victim and typically without their knowledge," the FBI said.
That resale is what causes the second wave of harm. New criminals buy the pack, see the victim's real name and social handles, and start their own blackmail attempts. Some even post the stolen images on the victim's own social media page to humiliate them into paying.
What should ordinary people actually do?
Four things, in plain terms.
| Step | What it means |
|---|---|
| Ignore code requests | No real service ever asks you to share a login code sent by SMS or email. |
| Turn on multi-factor authentication | A second check, usually an app on your phone, that stops a stolen password on its own from being enough. |
| Do not store nudes in the cloud | Photos on iCloud, Google Photos or a social account are one password away from a stranger. |
| Report, do not reply | If you get a sextortion threat, stop talking to the sender and contact the FBI or local police. |
Sentences for the criminals are heavy when they are caught. One recent case involved 145 child victims, some as young as six years old, and an eight-year prison-length prosecution ended in a 33-year sentence.
The operational takeaway: your nudes are only as safe as your weakest login, and that login is usually one SMS code away from a stranger.
Common questions
Is it safe to store intimate photos in iCloud or Google Photos?
The FBI's advice is no. Any photo stored in an account that can be logged into from the internet can be stolen if that account is broken into.
What should I do if a stranger messages me threatening to leak photos?
Stop replying immediately, do not pay, and report it to the FBI at ic3.gov or your local police. Paying rarely ends the threats, and every reply teaches the criminal you are a live target.
