The FBI has issued a formal sextortion warning, alerting both adults and minors that cybercriminals are breaking into social media and personal accounts to steal intimate images and sell them on the dark web. The advisory, published by the FBI’s Internet Crime Complaint Center (IC3) on 10 August 2026 under Alert Number I-081026-PSA, describes the stolen content using the technical term ‘non-consensual intimate images’ (NCII).
What the FBI Sextortion Warning Covers
Once stolen, images are posted to the dark web alongside personal details including the victim’s name, date of birth, email address, phone number, and social media username. From there, criminals use the material to run blackmail schemes, which the FBI describes as sexual extortion, or sextortion.
The IC3 advisory warns that victims can face re-victimisation through harassment, stalking, and other targeted attacks, including having stolen content advertised on their own social media pages. Rachel Tobac, chief executive of security awareness training firm SocialProof Security, told TechCrunch that the FBI choosing to issue a public alert of this kind could indicate these incidents are now on the rise.
The advisory notes that attackers target individuals who are known or unknown to them, as well as what the FBI calls ‘general targets of opportunity,’ meaning victims are not always chosen for a specific reason.
The FBI identified three core tactics. The first involves password cracking: hackers start from lists of websites that have suffered data breaches, then use brute-force software to recover passwords tied to leaked accounts. The second is SMS impersonation, where a hacker texts a user posing as the platform’s customer support team, claims the account is being locked, and then requests a password-reset code from the real company. Once the user hands over that code, the hacker takes control.
The third tactic is phishing via email: attackers create domains and addresses designed to look like official platform support, warn users of suspicious logins, and include a malicious link prompting a password change. The Record, from Recorded Future News, reports that the FBI notice also covers a fourth method not described in the IC3 advisory’s main breakdown: cloned social media sites that appear legitimate but send any login credentials entered directly to the attackers.
How to Protect Your Accounts
The FBI’s primary instruction is straightforward: do not store sensitive images or videos on social media platforms or public internet sites.
Beyond that, the agency recommends using unique and complex passwords and passphrases for every account, avoiding personal information such as dates of birth when creating them. TechCrunch notes that a password manager is a practical way to store unique credentials across accounts without needing to memorise them all.
Multi-factor authentication should be enabled wherever it is available to verify any login attempt. The FBI also advises against clicking embedded links in emails or text messages; users should navigate directly to the platform’s website instead. On a computer, hovering over a link before clicking reveals the underlying URL, making it easier to spot irregular formatting. TechCrunch adds that tech companies do not typically contact their customers unprompted, so an unsolicited message claiming account trouble should always be treated with suspicion.
If a temporary password, PIN reset, or access code arrives without being requested, the FBI says users should be cautious. Login credentials should never be shared with anyone, regardless of what the sender claims. Any password or PIN changes should be made through the platform’s own official website or app.
The IC3 advisory instructs victims to report non-consensual intimate images at ncii.ic3.gov. It also points to several support organisations, including the National Center for Missing and Exploited Children (NCMEC) and its NetSmartz Initiative, the National Center for Victims of Internet and Cyber Exploitation, and the Federal Trade Commission‘s Take It Down Portal, which is designed to help individuals remove intimate images from online platforms.
The FBI asks anyone who believes they have been targeted to file a report with the IC3 at ic3.gov, including as much detail as possible about the incident.