FBI Alert: Hackers Are Stealing Intimate Photos to Extort Adults and Minors in Sextortion Scams

TL;DR

• The FBI has issued a new alert warning that hackers are breaking into email, cloud storage, and social media accounts to steal private and intimate photos for sextortion.
• Attackers are using stolen credentials, phishing, and malware to access accounts, then threatening to leak images unless victims pay money or send more explicit content, with both adults and minors being heavily targeted.
• The FBI urges everyone to enable multi-factor authentication, use strong unique passwords, and never pay or comply with extortion demands, and to report incidents immediately to the FBI's Internet Crime Complaint Center.

A Dangerous New Twist on Sextortion

The FBI is warning about a sharp rise in a particularly invasive form of sextortion. Unlike traditional scams where criminals trick victims into sharing intimate images voluntarily, this new wave involves hackers actively breaking into victims' accounts to steal them.

In its latest alert, the FBI says cybercriminals are compromising online accounts — including email, cloud photo storage, and social media — to hunt for sensitive personal photos and videos. Once they find intimate content, they use it as leverage to extort victims for money, additional explicit images, or other demands under the threat of publicly releasing the material to family, friends, employers, or the open web.

The agency notes that reports of this tactic have increased significantly, and the financial and psychological toll on victims is severe.

How the Hack-to-Extort Scheme Works

According to the FBI, these attacks typically unfold in several stages:

First, hackers gain access to an account. They most often do this through credential stuffing using usernames and passwords leaked in previous data breaches, phishing emails and fake login pages that steal credentials, or malware and infostealers that harvest saved passwords from a victim's device.

Once inside, they quietly search for content. Attackers will comb through cloud backups like iCloud or Google Photos, email attachments, and direct messages on platforms like Facebook, Instagram, Snapchat, and Discord, looking for nude or intimate images. They also steal contact lists and private information to increase their leverage.

Then comes the extortion. Victims receive a threatening message, often via email, direct message, or text, containing proof that the attacker has their intimate images. The criminals demand payment, usually in cryptocurrency, gift cards, or wire transfers, or pressure victims to produce more sexual content. They threaten to send the images to everyone in the victim's contact list or post them on pornographic or public sites if the demands are not met within a short deadline.

Why Adults and Minors Are Both at Risk

While sextortion has long been associated with romance scams and catfishing, the FBI stresses that this account-hacking method puts everyone at risk.

For adults, stolen intimate images are used for financial extortion. Victims often feel deep shame and fear of reputational damage, which makes them more likely to pay. The FBI warns that paying rarely helps, as it often leads to escalating demands for more money.

For minors, the crime is even more alarming. Hackers who steal images of children, or who trick minors into storing images in compromised accounts, may use the material for sexual exploitation and to coerce minors into producing additional child sexual abuse material. The FBI has classified this as a major threat to children and teens, who may be less equipped to handle the threats and less likely to seek help from a parent or trusted adult.

Because many people automatically back up all photos from their phones to the cloud, even old or deleted intimate images can remain accessible to an attacker who compromises the account.

How to Secure Your Accounts and Protect Yourself

The FBI and cybersecurity experts recommend taking immediate steps to lock down your accounts and reduce your exposure:

Lock Down Your Logins

Enable multi-factor authentication (MFA) on every important account, especially email, cloud storage, and social media. Use an authenticator app or security key rather than SMS codes when possible. Use long, unique passwords for each account and consider a password manager to keep track of them.

Practice Good Digital Hygiene

Be cautious of phishing attempts. Do not click on suspicious links or enter your credentials on unfamiliar sites. Keep your devices, browsers, and antivirus software updated to protect against malware that steals passwords. Regularly review your cloud storage and delete sensitive images you no longer need, and check your account's recent login activity for unfamiliar devices or locations.

Limit What You Store and Share

Be mindful of where intimate images are stored. Disable automatic cloud backups for sensitive photos if you choose to keep them, and consider storing them offline in an encrypted folder rather than in email or cloud services. Be careful about what permissions you grant to third-party apps.

What to Do If You Are Targeted

If you receive a sextortion threat, experts say it is critical not to panic, pay, or comply with demands for more images. Paying does not guarantee the images will be deleted and often marks you as a willing target for further extortion.

Do not delete the messages, as they are evidence. Take screenshots of the threats and the extortionist's account information. Block the attacker but do not engage in further conversation.

Report the crime immediately to the FBI's Internet Crime Complaint Center at ic3.gov and to your local FBI field office. If a minor is involved, also contact the National Center for Missing & Exploited Children's CyberTipline. You should also report the account compromise and extortion attempt to the platform where it occurred.

If you need emotional support, reach out to a trusted friend, family member, or counselor. Remember that you are the victim of a crime, and help is available.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.