Illinois man gets 76 months for phishing 750 women's Snapchat accounts

Key points

• Kyle Svara, 26, of Illinois was sentenced on Tuesday to 76 months in federal prison followed by three years of supervised release.
• He phished login codes from more than 750 women between May 2020 and February 2021, targeting over 4,500 potential victims in total.
• He broke into roughly 517 Snapchat accounts, downloaded nude or semi-nude images, and locked the owners out by turning on two-factor authentication.
• Investigators found around 530 images and 600 videos of child sexual abuse material in his Mega cloud storage account.
• One paying client, former Northeastern University track coach Steve Waithe, was sentenced to five years in March 2024 for related offences.

A federal judge this week handed down a 76-month prison sentence to Kyle Svara, an Illinois man who broke into hundreds of women's Snapchat accounts to steal intimate photos and sell them on. The case, first reported by BleepingComputer, closes out a scheme that ran for the better part of a year and hit thousands of women across several states.

Svara, now 26, pleaded guilty in February after being charged in December. He will also serve three years of supervised release once he leaves prison.

How did he actually break into the accounts?

He tricked the victims into handing him their login codes. There was no clever exploit and no software flaw at Snap Inc. Svara used social engineering, meaning he impersonated someone trustworthy to fool people into giving up secrets. In this case he posed as a Snapchat support representative, called from anonymised phone numbers, and asked women for the one-time codes Snapchat sends to verify a login.

Once he had a code, he signed in, downloaded any nude or semi-nude photos in the account, and then switched on two-factor authentication, an extra login step, using his own details. That locked the real owner out.

Between May 2020 and February 2021 he approached more than 4,500 women this way. Prosecutors say around 750 gave up their codes, and he raided roughly 517 accounts.

Who were the victims?

Mostly young women he found through personal or campus connections. Court filings describe neighbours, family friends, classmates and personal friends in Plainfield, Illinois, along with students at Colby College in Waterville, Maine.

Some of the hacking was paid work. Svara advertised on the encrypted messaging app Kik, offering to "get into girls snap accounts" for anyone who would pay or trade images. One customer, former Northeastern University track and field coach Steve Waithe, hired him to target Northeastern students and members of the women's track and soccer teams. Waithe was sentenced in March 2024 to five years for cyber fraud, cyberstalking and sextortion after prosecutors tied him to at least 128 victims.

What else did investigators find?

Child sexual abuse material. Prosecutors said Svara's Mega cloud storage account held roughly 530 images and 600 videos of CSAM, and that he distributed and solicited the material despite telling investigators he had no interest in it. The Justice Department noted he also denied any knowledge of Snapchat hacking in his interview, which court records show was untrue.

What should Snapchat users take from this?

Treat any call, text or message asking for a login code as hostile, even if the caller claims to be from Snap. Snapchat will not ring you and ask for the code it just sent to your phone. If someone does, hang up. If you have lost access to an account, use Snap's in-app recovery flow rather than a number a stranger gave you. Turning on two-factor authentication yourself, with an app like Google Authenticator, makes it far harder for someone else to switch it on against you.