Instagram Users Get Locked out After an Unexplained Russian Hack

Quite a few Instagram users have had their accounts hijacked. It's not a selection of separate incidents. It seems to be a coordinated campaign that, by the looks of things, is carried out by the same group of cybercriminals. It's difficult to say when the first accounts got compromised, we don't know how many people are affected, and it's not clear what the hackers' motives are. On the whole, information is quite scarce, but nevertheless, we'll summarize what we know.

Russian (possibly) hackers with a penchant for movies and cartoons

The hackers are careful to ensure that victims have few options of getting their accounts back. Apparently, after breaking in, the crooks change the password, remove the phone number associated with the account, and swap the user's email address for one registered at a Russian email provider. When the .ru address (which doesn't necessarily mean that the perpetrators are Russian) is assigned, the victims do receive a notification to their original emails, but usually, by the time they manage to log in and rectify the situation, it's already too late.

Fortunately, so far, we've yet to see the hackers deleting photos which should be a relief for quite a few people, as many Instagram users store some pretty valuable memories in their accounts. In fact, it's difficult to judge what the hackers want. So far, we've seen them put new names on the hijacked accounts as well as profile pictures that appear to have been taken from Hollywood movies and cartoons.

Instagram doesn't appear to be handling this very well

Considering the amount of noise this has generated (even the BBC has now reported on the issue), Instagram seems to be curiously quiet about the whole thing. The only official communication that's come out of the photo sharing platform is a short statement saying that an investigation is ongoing and not much else.

The Facebook-owned company does encourage its users to enable two-factor authentication and use a strong password, but that's hardly helpful for the hundreds (possibly thousands) of people who have already been locked out of their accounts.

Speaking of which, many victims have taken to Twitter to vent their frustration, and judging by their tweets, we can conclude that people started experiencing troubles at least ten days ago. In ten days, Instagram's security professionals have apparently failed to isolate the issue as at the time of writing, we're still seeing users complaining about login problems. The other thing we learn from people's reactions on Twitter is that the recovery procedure when you've been cut off from your account is cumbersome.

We'll be keeping an eye on the situation, and in the meantime, if you're an Instagram user, you should think about the security of your account. If you feel that your password is not strong enough, go and change it, and make sure that two-factor authentication is turned on.