A Hacked Instagram Account

I woke up this morning and started the day with my usual routine. Shortly after I got out of bed, my wife received a phone call. I initially thought it to be a work associate but then I discovered her sister called. My wife's Instagram account got hacked and her sister wanted to warn her to update her password. My wife immediately went into her office and changed her Instagram password. My son also sent my wife a text message letting her know her account had been hacked.

Now I will confess that I don't even own an Instagram account so I am not sure how my son and wife's sister knew the account had been hacked. When I talked to my wife she said they both received "Follow" requests and incoherent messages. I assume that meant the hacker tried to contact all of my wife's Instagram connections. If I hacked my wife's account I assure you I would have been much more intelligent in my actions. I probably would have promoted my YouTube channel or something equally beneficial to me.

After changing Instagram credentials my wife logged into her Facebook account and changed her password there. Facebook owns Instagram and the two services are tightly linked and a breach in one account could lead to a breach in the other. Unfortunately my wife's Facebook account initially wouldn't let her change the password. She had to force a security code to be sent her and then she could change it. My guess is that the IP address associated with our Google Fiber account recently updated and it looks to Facebook like my wife is using an unknown computer to access the service. Ultimately my wife updated both Facebook and Instagram login credentials.

Now the question I have is how someone hacked my wife's account in the first place. Unfortunately all I can do is guess. Perhaps they discovered her password that is common with another account. That would be my first guess and underscores the importance of using separate passwords for all of your different logins. Other additional security measures include 2-factor or multi-factor authentication and passphrases that rely on face recognition or fingerprints. Unfortunately we live in a time when passwords may not be enough.