Illinois man gets 76 months for phishing 750 women's Snapchat accounts

Key points

• Kyle Svara, 26, of Illinois was sentenced Tuesday to 76 months in federal prison followed by three years of supervised release.
• He phished login codes from more than 750 women between May 2020 and February 2021, targeting over 4,500 potential victims in total.
• He broke into roughly 517 Snapchat accounts, downloaded nude or semi-nude images, and locked owners out by turning on two-factor authentication.
• Investigators found around 530 images and 600 videos of child sexual abuse material in his Mega cloud storage account.
• Former Northeastern University track and field coach Steve Waithe was sentenced to five years in March 2024 for related offences.

A federal judge this week handed Kyle Svara 76 months in prison for breaking into hundreds of women's Snapchat accounts to steal intimate photos. No software flaw at Snap enabled any of it. The case closed out a scheme that ran for nearly a year and touched thousands of women.

Svara, 26, pleaded guilty in February after being charged in December. Three years of supervised release follow the prison term.

How did he actually break into the accounts?

Social engineering, not a technical exploit. Svara impersonated a Snapchat support representative, called from anonymised phone numbers, and asked women for the one-time codes Snapchat sends to verify a login. We covered how phishing attacks are constructed on 23 July; this case is a clean example of voice phishing against a single platform.

Once he had a code, he signed in, then activated two-factor authentication using his own details. That locked the real owner out and gave him the account. Between May 2020 and February 2021 he approached more than 4,500 women this way. Prosecutors say around 750 handed over codes; he raided roughly 517 accounts, downloading nude or semi-nude photos from each.

Who were the victims?

Mostly young women he found through personal or campus connections: neighbours, family friends and classmates in Plainfield, Illinois, plus students at Colby College in Waterville, Maine.

Some jobs were paid. Svara advertised on the encrypted messaging app Kik, offering to "get into girls snap accounts" for payment or traded images. Former Northeastern University track and field coach Steve Waithe hired him to target Northeastern students and members of the women's track and soccer teams. Waithe was convicted of targeting at least 128 women and sentenced in March 2024 to five years for cyber fraud, cyberstalking and sextortion.

What else did investigators find?

Child sexual abuse material. Prosecutors said Svara's Mega account held roughly 530 images and 600 videos of CSAM, and that he distributed and solicited the material despite telling investigators he had no interest in it. The Justice Department also noted he denied any knowledge of Snapchat hacking during his interview, which court records show was false on both counts.

Our reporting on the global surge in sadistic online exploitation of teenagers on 22 July showed how platform-level detection gaps let this material spread; Svara's Mega cache is a concrete illustration of that problem.

Should you worry about this kind of attack?

If you use Snapchat, yes. Snap won't call you to ask for a code it just sent. Any request for a one-time login code, regardless of who claims to be asking, should be treated as hostile. Hang up. Use Snap's in-app recovery flow if you've lost access, not a number a stranger provided. Setting up two-factor authentication yourself through an authenticator app makes it harder for someone else to flip it on against you.

The operational point worth sitting with: Svara hit more than 4,500 women with no technical skill whatsoever. Credential phishing via phone call is cheap, scalable and devastatingly effective against platforms that rely on SMS codes.