Facebook, Instagram, TikTok, and Twitter took coordinated action to take down top members of account hijacking forum OGUsers and seized hundreds of accounts
who hack, SIM swap, extort to get high value usernames—and has sent them legal letters demanding they stop. Also disabled their accounts. Twitter + TikTok too https://www.vice.com/... @briankrebs : To get a sense of the $$ involved in selling hijacked social media accounts, just 2 BTC accounts used by 1 of the many brokers targeted by Instagram today processed 243 bitcoins, or ~ $8.5M. The middleman/broker's take would be worth ~$425,000 now. https://krebsonsecurity.com/ ... https://twitter.com/... Dr. Emma Sandoe / @emma_sandoe : As someone who was harassed, threatened, and my personal accounts hacked over my Instagram username- this is overdue very good news. https://www.nytimes.com/... Joseph Cox / @josephfcox : Updated: spoke to one of the OGUsers implicated in Instagram's action. Said they're speaking to their lawyer this afternoon after Instagram unmasked them and sent a legal threat https://www.vice.com/... https://twitter.com/... Sarah Frier / @sarahfrier : Instagram took down 100s of valuable accounts that were hacked in an attempt to resell. They also sent a cease-and-desist letter to the hacking group, which they saw using increasingly violent and exploitative tactics like SWATting to get what they wanted https://www.bloomberg.com/... Casey Newton / @caseynewton : User accounts are valuable; protecting them against theft is a basic customer-service issue that I wish all platforms took more seriously. Glad to see Instagram fighting this battle https://twitter.com/... Joseph Cox / @josephfcox : Twitter and TikTok said they also enforced on a number of accounts; Twitter said after working with Facebook https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : We've been covering OGUsers since around 2018. The people who steal usernames have moved onto stealing vast quantities of bitcoin through SIM swapping, and more recently used sextortion (access email/cloud storage, use compromising images to blackmail) https://www.vice.com/... https://twitter.com/... Taylor Lorenz / @taylorlorenz : NEW: Instagram bans hundreds of accounts tied to hacking of OG usernames https://www.nytimes.com/... Joseph Cox / @josephfcox : The cease and desists that Instagram sent to members of the OGUsers community tell them to stop using their platforms; provide information on who else is involved in the activity; and threatens more actions if the person ignores the cease and desist https://www.vice.com/... https://twitter.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : Instagram has identified and deleted the accounts of prominent accounts stealers, most of them part of the infamous OGUsers community. The company has also sent them cease and desist letters. https://www.vice.com/... Joseph Cox / @josephfcox : It is highly unusual for social media companies to publicly announce that it has identified the real names of pseudonymous users and to announce publicly that it has sent them legal threats, especially when it comes to this sort of crime/activity https://www.vice.com/... https://twitter.com/... Jason Koebler / @jason_koebler : BREAKING: Instagram unmasked the real identities of account stealers & hackers on a private forum, shared info with Twitter & TikTok, and then threatened to sue these people. This type of off-platform action from Facebook is unprecedented as far as I know https://www.vice.com/... Joseph Cox / @josephfcox : Watched in real-time about 45 minutes ago Instagram accounts of OGUsers members go offline. Here are some of the impacted ones, screenshots taken beforehand https://www.vice.com/... https://twitter.com/...
Context & Ripple Effects
OGUsers had already been documented as a market for social-media and gaming handles, including handles obtained through SIM-hijacking attacks. Separate reporting on phishing of Instagram influencers through fake sponsorship offers showed why control of established accounts has resale and abuse value.
The new element is coordinated enforcement: Instagram identified alleged members and shared account and identity information with Facebook, Twitter, and TikTok, turning a platform-level response into a joint disruption effort.
First-order effects
- Facebook, Instagram, TikTok, and Twitter disabled or seized hundreds of accounts tied to OGUsers, immediately cutting off the named members' access to those accounts.
- Instagram's cease-and-desist letters put identified alleged members on formal notice alongside the account actions.
Second-order effects
- Account brokers and hijacking operators lose the ability to treat another major social platform as a simple fallback when identity information is shared across services.
- The coordinated removals reduce the pool of valuable accounts available to a forum whose trade was built around stolen handles and account access.
Third-order effects
- If platforms sustain identity-sharing enforcement against account-hijacking networks, account security becomes a cross-platform trust function rather than a series of isolated moderation decisions.
- That model concentrates more of the practical deterrent power in the largest platforms able to connect identity and account signals across services.
The trend: Major social platforms are moving from individual account takedowns toward coordinated disruption of the networks that monetize account access.