FBI warns criminals are hunting nude photos in hacked accounts
The bureau says attackers are breaking into social media and cloud accounts to steal intimate images, then using them for blackmail, resale on criminal sites, and follow-on sextortion attacks against victims and their families.
Key points
- The FBI issued a public warning this week that criminals are breaking into online accounts specifically to steal sexually explicit photos and videos of adults and children.
- Stolen images are being resold on criminal marketplaces along with victims' names, dates of birth, phone numbers and social media handles.
- The FBI and the National Collegiate Athletic Association (NCAA) issued a joint warning the same day that college student-athletes are being targeted in the same schemes.
- Common lures include fake text messages demanding a verification code and fake password-reset emails.
- In May, a Canadian man was sentenced to 33 years in prison for a sextortion scheme targeting more than 145 children in the United States, some as young as six years old.
The FBI has a blunt message for anyone with a phone: criminals are now hunting inside people's accounts for nude photos and videos, and the fallout doesn't stop at the theft.
In a public service announcement this week, first reported by BleepingComputer, the bureau said attackers are breaking into social media and cloud storage accounts to pull out intimate images. They then use those images to blackmail the victim, sell them on criminal websites, or hand them to other criminals who keep the pressure going.
That follow-on pressure has a name. Sextortion is a form of online blackmail where a criminal threatens to publish nude images unless the victim pays money or sends more explicit content. We've tracked this pattern across fourteen stories since 15 July, and the mechanics haven't changed: the volume has.
How are the criminals getting in?
Mostly by tricking people into handing over the keys. The FBI says the two most common lures right now are fake text messages claiming an account will be shut down unless you enter a verification code, and fake emails saying someone just logged in and you need to click a link to reset your password.
Both are phishing: messages designed to look real so you type your password or one-time code into a site the criminal controls. A real company won't ask you to read back a verification code or a PIN reset code. If a message asks for one, it's a scam.
Who is being targeted?
Everyone with an account, but the FBI called out two groups specifically. Children are being targeted through the platforms they already use. On the same day as the main alert, the FBI joined with the NCAA, the body that runs U.S. College sports, to warn that student-athletes are being singled out. Coaches, compliance staff along with athletic department leadership were asked to warn their players directly.
What happens after the images are stolen?
The images don't just sit in one criminal's hands. "Once the sexually explicit content is stolen, SE actors post or sell it to criminal marketplaces, which often includes personal information about the victim and typically without their knowledge," the FBI said.
That resale is what causes the second wave of harm. New criminals buy the pack, find the victim's real name and social handles, and start their own blackmail attempts. Some post stolen images on the victim's own social media page to humiliate them into paying. Our 24 July report on Kyle Svara, who phished 750 Snapchat accounts by posing as Snap staff, is a clean example of exactly this chain.
What should ordinary people actually do?
Four steps, in plain terms.
| Step | What it means |
|---|---|
| Ignore code requests | No real service ever asks you to share a login code sent by SMS or email. |
| Turn on multi-factor authentication | A second check, usually an app on your phone, that stops a stolen password on its own from being enough. |
| Don't store nudes in the cloud | Photos on iCloud or Google Photos are one compromised password away from a stranger. |
| Report, don't reply | If you get a sextortion threat, stop talking to the sender and contact the FBI at ic3.gov or local police. |
Sentences are heavy when criminals are caught. The Canadian case cited by the FBI involved 145 child victims across an eight-year scheme and ended in 33 years in prison.
Your account's weakest login is the attack surface. Fix that first.
Common questions
Is it safe to store intimate photos in iCloud or Google Photos?
The FBI's position is no. Any photo stored in an account reachable from the internet can be stolen if that account is compromised.
What should I do if a stranger messages me threatening to leak photos?
Stop replying immediately, don't pay, and report it to the FBI at ic3.gov or your local police. Paying rarely ends the threats, and every reply confirms to the criminal that you're a live target.
