The Growing Threat of Account Takeovers

TechCrunch recently reported that the FBI has issued a warning about cybercriminals hacking into social media and online accounts to steal intimate images and videos. The attackers use social engineering tricks—like fake customer support calls or phishing emails—to get passwords, then extort victims or post stolen content publicly.

This is not a new problem, but the FBI’s alert suggests these attacks are becoming more common. For Australian small and mid-sized businesses, this story is a reminder that the same tactics used to target personal accounts are also used to break into business systems. Weak passwords and trust in unsolicited messages remain the weakest links.

Why This Matters for Digital Trust

The core issue here is trust—both personal and professional. When a hacker impersonates a legitimate company, they destroy confidence in digital communications. For businesses, this means employees and customers can be tricked by convincing fake emails that look like they come from your own company or a partner.

These attacks rely on a technique called "credential stuffing," where hackers use leaked passwords from one site to break into accounts on another site. Many people reuse the same password across multiple services. The FBI alert specifically mentions brute-forcing accounts with reused passwords. For Australian SMBs, this is a critical risk—if an employee uses their work email password for a personal social media account, a breach there can lead directly to your business network.

What This Means for Australian SMBs

Australian small and mid-sized businesses often have limited cybersecurity budgets and rely on trust. But the same social engineering that targets intimate photos can target your company’s financial accounts, client databases, or intellectual property. The emotional and reputational damage to your business can be severe.

Moreover, if your business stores any customer data—names, emails, photos, or payment details—you have a legal obligation under Australian privacy law to protect it. An account takeover that exposes client information could lead to regulatory fines and loss of customer trust that takes years to rebuild.

What You Can Do Now

  • Enforce multi-factor authentication (MFA) on every business account, especially email, cloud storage, and financial systems. MFA stops most stolen-password attacks.
  • Use a password manager to generate and store unique, strong passwords for every service. Never reuse passwords between personal and work accounts.
  • Train all staff to recognise phishing and social engineering tactics. Teach them that legitimate companies rarely call or email asking for passwords or to “verify” account details.
  • Limit what sensitive information you store in online accounts. If you don’t need it, delete it. For anything you must keep, use encrypted backups offline.
  • Set up clear incident-response procedures. If an account is compromised, act fast: reset passwords, revoke session tokens, notify affected parties, and report the breach to the Office of the Australian Information Commissioner if required.

At MS&VG, we help Australian businesses strengthen their digital defences with practical advice and tools tailored to small and mid-sized teams. If you need a security review or staff training, we’re here to help you stay safe without the jargon.