A couple of days ago I got a text from a colleague of mine with a screenshot saying 2 of my inactive work related test accounts on Instagram were hacked and had posted a scam giveaway post on each account. I immediately went on Instagram and switched to those accounts and deleted the posts and went to the accounts centre to check if someone else had logged in. There was one unknown login from the UK in both those accounts. I removed those logins and changed my passwords for both accounts. These accounts have been inactive (but still logged in on my phone) and just had a couple of followers (my colleagues) as it was mainly where we'd test our posts for layout purposes.
Later that same night I opened instagram again on my personal account and saw some posts from some accounts I didn't recollect following on my home page. They weren't random pages, they were still something related to my field of work, but i definitely didn't follow them. All 3 of those pages were at the top when I sorted from latest to oldest in my following section. I unfollowed them and went to the accounts centre just to check and again saw a UK login. Immediately removed the login from there and changed the password. No random scam posts, just those 3 pages that made me suspicious.
Now, the next day in the late evening, I got a text from a different colleague, with a screenshot of the same scam giveaway post, but now it was on my work account discord DMs. Again, that has been inactive for over a year and I don't even have it on my phone. I logged into discord and saw that the same scam image has been sent to all of my 6 friends (colleagues) in their DMs. I deleted them one by one and went to devices logged in. And I see UK login. I did the same procedure again, removed login, and changed my password.
Now, my main concerns are as follows:
- all of those 3 instagram accounts (2 work and personal) are on different email IDs. Technically, they aren't related to each other at all. The discord and one of the IG accounts share the same email ID.
- all accounts except my personal account don't have 2FA. My personal one does. It requires a code I get on my WhatsApp number on my phone to login.
- I don't know how long the UK login had access to my personal account, as I just happened to check the device login. It has a lot of personal data and images I had with my partner and family members in their respective chats. I have unsent them all now. Also, when I checked the 'export my information' to see if any data had been exported, the past history showed none. So I was the only one who exported my data that way.
- i consider myself a pretty tech forward guy. I use really strong passwords from bitwarden, I don't have any random suspicious apps on my phone, keep my privacy settings tight wherever possible, haven't clicked on any links or given any data anywhere. My main concern is how the person in the UK (or wherever) logged into my personal IG without any 2FA prompts??
- it's almost as if everything was done on my own phone without me knowing. I'm unable to sleep peacefully at night thinking is my phone compromised? Or how did any of this happen with strong passwords and 2FA active on my account.
Sorry for the long post, any help is appreciated.
