FBI warns your private pics are at new risk of theft — here’s how to secure them now

Passwords have been under threat lately, with attacks hitting big-name password manager apps and vulnerabilities found inside the “more secure” Passkeys, but these aren’t the only pieces of personal information at risk right now.

The FBI issued a new warning that cybercriminals are scouring personal accounts and social media for explicit photos of adults and minors that can be used to stalk, harass, and extort victims for personal gain.

Images are usually taken without users’ knowledge and sold online on the black market.

Here’s what you need to know and what you can do to stay safe.

Warning from the FBI

In mid-August, the FBI released a stark warning that sexual exploitation (SE) actors are on the prowl looking for compromising photos of potential victims to sell online for profit. These criminals aren’t just using one attack vector — like leaked passwords online — to gain access to accounts either. Instead, they’re employing “a variety of social engineering and cyber intrusion tactics to target specific individuals of interest.” Targets can be anyone: public officials, celebrities, common civilians who pique their interest, and even complete strangers. Everyone is fair game.

The explicit images in question are usually taken without users’ knowledge, and when they’re sold online on the black market, sellers include the victim’s name, date of birth, email, phone number, and even their social media username for maximum impact and potential re-targeting campaigns by other criminals who may also wish to exploit the same victim.

3 ways criminals gain access to intimate photos

The FBI notes that these SE actors are gaining access to user accounts through the following methods:

1. Password and pin targeting is a process where criminals test a combination of pins and passwords to gain access to a targeted account. Considered a brute-force hack, this process can be both arduous and tedious. However, criminals are reportedly using recent password and data leaks to narrow down the possibilities, making everyone an easy target.

2. Criminals are posing as customer service representatives on major social media platforms where they send threatening messages to potential targets, warning them that their account will be locked or disabled unless they reset their password using a spoofed system hosted by the criminal.

3. When all else fails, an old-fashioned phishing scheme is their last line of attack. In this case, bad actors send emails to potential victims telling them that their account was breached and that the password must be changed, again using a spoofed website hosted by the criminal where they get direct access to the new password in the end.

How to protect yourself from SE actors

Luckily, there are things you can do to shore up security on your accounts and keep your most private photos safe. The FBI outlines several clear recommendations, to which we’ve added our own tips.

RELATED: How to get Google AI off your smartphone now

Yurii Karvatskyi/Getty Images

Together, all of these can keep you and your data much safer online:

1. Refrain from storing private images on social media, websites, or cloud-connected accounts where they can be accessed by a third party. Don’t even keep these images in your drafts. If your accounts are breached, everything saved inside belongs to the intruders.

2. If you do keep any sensitive images on your phone, make sure they’re saved inside a password-protected or locked folder to add an extra level of security and scrutiny. Both Apple Photos on iOS and Google Photos on Android and iOS have these options built in.

3. Use complex passwords to secure all of your accounts, and make sure you change these passwords often — every three to six months is generally a good idea.

4. Rely on Passkeys when applicable. Even though there is a bug on iOS that can expose your IP address to websites when using iCloud Private Relay, Passkeys are still more secure overall as they require someone to physically have your device in their hand in order to access your account.

5. Enable two-factor authentication for even more protection. This requires hackers to have access to your email or phone number, in addition to your other account information, making a successful attack less likely.

6. Never click on embedded links sent to you through email or a messaging app, even if you think they originated from an official social media company. Instead, always go directly to the host website to change your password.

7. If you ever receive a password reset PIN that you did not request, ignore it. Then log onto the website directly and change your password manually from there to ensure your account is secure.

Cyber criminals are getting bolder these days, but you’re smarter. Follow these tips, and you have a much better chance at thwarting any future attempts to access your accounts and steal your photos or other personal data.