At onBRANDING, we have detected in recent months—and even days—a considerable increase in the hacking of Instagram accounts belonging to public figures by cybercriminals.

When a victim decides to use our services, as a rule, it is after having suffered some type of security attack. Most likely, before this issue affected them, they had experienced other situations, such as cyberbullying or failed attempts to access their account or communications.

In rare cases, victims seek help in these early stages of a cyberattack, and generally they do so after the situation has worsened.

Averum, a law firm specialising in the right to honour and reputation and a collaborator of onBRANDING, explains in this post the main offences a cybercriminal commits when hacking social media accounts, and the criminal consequences arising from this act.

Courses of action in response to social media account hacking.

In the event of a social media hack, we must divide the action plan into two clearly distinct phases:

1) Immediate digital phase.

Through a response led by onBRANDING. In this phase, we would carry out the following actions:

• Detection and removal of information and personal or private data that may be sensitive from a reputational, security, or privacy standpoint.
• Collection of the digital evidence required to take legal action.

At onBRANDING, based on our experience and the high demand for assistance from public figures this November, we have developed a meticulous internal response protocol enabling clients to manage their report to the competent authorities, as well as provide legally certified digital evidence to submit with the report.

However, it does not end with filing a report. It is necessary to:

• Restore the situation.
• Return control of personal devices and accounts to the user.
• Protect their communications to prevent future cybersecurity issues.

This is only possible with the best ethical hacking team and digital reputation experts, capable of:

• Identify the offence.
• Obtain and present the necessary digital evidence.
• Prepare Digital Forensics reports on the account hack.
• Return control of hacked accounts and devices.
• Raise the victim’s awareness and train them in self-protection.

2) Judicial phase.

This consists of providing all data gathered in the first phase to the police or the court so that the corresponding proceedings are opened to investigate the offence and determine the resulting liability of the offending parties.

Hacking an Instagram account involves multiple offences that victims are rarely aware of and do not usually report. Undoubtedly, this set of behaviours entails legal liability, as the offences committed may include:

• Unlawful access to communications.
• Identity impersonation.
• Extortion.
• Possible access to “digital wallets”, such as BitCoins, with resulting theft or extortion.
• Attempted access to bank accounts.
• Disclosure of secrets.

The motivations of cybercriminals when unlawfully accessing a public figure’s Instagram account, as a rule, focus on extortion to obtain immediate financial gain.

Can a cybercriminal—sometimes incorrectly called a “hacker”—be identified and legal action taken against them?

As soon as we have overcome the “immediate digital phase” at onBRANDING by gathering all kinds of evidence about the incident, we must make a legal approach that is as precise as possible so as not to encounter the routine responses that courts and police stations provide daily, which could lead to a refusal to open proceedings.

But how do I start such procedures if I wish to hold someone accountable for being the victim of account hacking on my social networks? And what if I have also been extorted, blackmailed, or threatened because the hacker obtained sensitive information?

Averum clarifies this below.

First, we must correctly distinguish the various offences the person in question may have committed; that is, rigorously break down the steps taken by the cybercriminal in order to file a report with solid legal grounding.

1) Unauthorised access to Instagram accounts.

The initial step the cybercriminal takes to achieve their objectives is to access the social network itself without the account holder’s consent, which leads us to state that such conduct falls under Art. 197.1 and 197.2 of the Criminal Code (offence of disclosure of secrets) as an intentional offence.

For this purpose, we must distinguish the two actions observed: on the one hand, the act of obtaining, intercepting, or using technical devices and, on the other hand, the intent with which the cybercriminal carries out a second action consisting of violating the account holder’s privacy.

2) Extortion as a consequence of obtaining sensitive information.

As stated at the outset, this series of criminal behaviours is generally carried out to achieve an end. For example, the hacker may access the account in order to obtain sensitive information and extort the account holder so that the latter pays them a certain amount of money (generally, in bitcoins).

Indeed, this conduct falls under Art. 243 of the Criminal Code, provided several elements of the offence are present: violence or intimidation, action or omission, legal transaction, financial harm, and intent.

3) Dissemination of intimate information.

In turn, one of the aims may simply be to disseminate sensitive information obtained through the account, which would give rise to civil and criminal liability under Art. 197.2 of the Criminal Code.

And when we speak of “intimate or sensitive information”, we are not referring only to delicate information (photos and data); it may simply refer to private conversations.

4) Spreading insults or false information.

At the same time, it may happen that the cybercriminal accessed the account and subsequently set about spreading false information or even direct insults, which would amount to the offence of insults and slander (Art. 205 et seq. of the Criminal Code) and could also give rise to civil proceedings under Organic Law 1/1982 of 5 May on civil protection of the right to honour, privacy, and one’s own image.

5) Identity theft.

Additionally, we could also be facing an offence of identity theft (Art. 401 of the Criminal Code) if the conduct is ongoing over time and the impersonator has fully assumed the civil status of the person impersonated.

6) “Hacking” offence (Art. 197 BIS)

Likewise, if the hacker, in order to access the account, intercepted a password, we could be facing a hacking offence contemplated in Art. 197 BIS of the Criminal Code.

But let us remember that, for such offences to be attributable to the responsible person, the method of informing the competent authorities of these facts may be by means of a police report or a private prosecution (if it is an offence against privacy), either drafted by the complainant themselves (if it is a report) or through their lawyer.

Aware of the immense overload of courts and bodies dependent on the Administration of Justice, AVERUM Abogados recommend initiating the matter professionally, drafting the report or private prosecution with the support of a specialist lawyer in order to justify from the outset the extent of the damage and the possible civil and/or criminal liability of the offending party.

Good planning is everything to achieve the objectives set, and let us remember: “what starts badly ends badly”. Given the seriousness of the facts, why not begin with rigour and professionalism from the start to put an end to these offences? Let us proceed.

The importance of reporting social media account hacking to law enforcement.

One of the problems victims face is the limited resources available to the competent authorities to help them (National Police, Guardia Civil, Mossos…).

Some barriers law enforcement bodies must face are:

• Low levels of training in cybersecurity.
• Limited involvement of qualified technical staff in operations.
• The financial resources allocated to cybercrime units.

Selva Orejón, CEO of onBRANDING, participates by delivering training in Cyber Intelligence and Cyber Investigation at the Police School of Catalonia with this same objective: to increase law enforcement capacity in tackling cybercrime.

This situation could improve if every victim of a cyberattack reports their case to the authorities. In this way, it could begin to be handled and investigated like any other type of offence committed outside the online environment.

The influx of clients affected by this type of offence during 2020 allows us to consider the very large scale this problem is taking on.

At onBRANDING, we have produced content related to cyberattacks and cybersecurity issues in recent months to raise awareness of the importance of increasing our security in the digital environment:

• Cyberattacks on hospitals during the pandemic.
• Email domain impersonation.
• A wave of Facebook account hacks and the collapse of Facebook’s help system.
• Hacking via malicious apps for Instagram.
• Sextortion campaign: porn extortion and blackmail by email during the COVID crisis.

The number of cybercrimes, phishing, ransomware attempts, and unlawful access to private accounts is sufficient for law enforcement units to be provided with effective resources to pursue cybercrime and social media account hacking.

The only way to achieve this is by REPORTING every case.

Hacking and extortion of public figures.

One of our most recent cases is the hacking of actress Cayetana Guillén Cuervo’s Instagram and Twitter accounts. She turned to our services because she was unable to regain access to her account and the assistance she could receive from law enforcement was limited.

After a few days of work, the team at onBRANDING managed to restore normality by returning access to her Instagram account.

In Cayetana’s case, they gained access to her Instagram account and her mobile phone through a link supposedly verified by Instagram, and through an acquaintance. Trusting the source, the actress clicked the link, and from there everything began.

The ultimate aim of this case was extortion to obtain financial gain. Generally, these types of cybercrimes help finance other criminal organisations and serious illicit activities, such as terrorist activities and groups such as Daesh.

Selva Orejón, CEO of onBRANDING, and the actress hosted a live session on her Instagram account to warn about the situation, how to prevent it, the risks, and the need to report each and every case:

User awareness.

Raising awareness among anonymous users, public figures, and brands is vital for cybersecurity prevention. We are all exposed online to a multitude of cybercrimes, such as phishing, ransomware, account hacking, identity impersonation, hijacking of private images, theft of banking credentials, and a long etcetera—so sophisticated, original, and tailored to the user as cybercriminals are capable of carrying out.

The lack of protection that users face when they become victims of this type of crime prevents them from seeing the legal options available to them.

Averum and onBRANDING are closely committed to pursuing cybercrime, offering direct and effective solutions to regain control of our privacy, act within the framework of the law, and guarantee the security of the content and communications of affected users.

Article in collaboration with the partner: