Alright, let me share the full story of how my 14-year-old Instagram account, @javier, was stolen and ended up in the hands of a hip-hop producer—and why I believe it was an inside job.

Background

First off, here’s some backstory: I’ve had the @javier username since October 2010, the same month the app launched. I joined so early, that I even have emails reporting bugs to @joshriedel, Instagram’s very first employee.

Over the past 14 years, I’ve received countless messages to buy my account. Early on, I made a conscious decision not to engage with these requests. Rather than blocking people, I simply ignored them or restricted their accounts when that feature became available.

A few years ago, I even created a quick iMovie compilation of some of the messages I received in 2018. Since then, the volume of messages has only increased.

I’ve keep taking screenshots of everyone who’s asked about acquiring my account. One interesting pattern: the majority of these requests come from profiles without any photos. I find it so weird that people are so eager to get a username when they don’t even share content!

The Theft

Alright, back to the story. On Wednesday, October 23rd, around 7 PM Spanish time, after I got killed for the thousandth time in Elden Ring, I opened Instagram and found myself logged out.

While I’d occasionally received notifications about suspicious activity requiring identity verification, this was different—a complete logout. When I saw this, I knew my worst fear had finally become reality: I had lost my Instagram account.

When I attempted to log back in, my password was rejected. Using the password recovery option, I discovered something alarming: the email associated with my account had been changed to an address I didn’t recognize: r*******e@gmail.com

At this point, my @javier account still displayed all my content, but I knew this wouldn’t last long. I tried Instagram’s hacked account reporting page, but it was ineffective: when I entered my username the page simply reloaded without any confirmation.

After exhausting all recovery methods, I refreshed my now-inaccessible account to find all my content replaced by 4 posts. Here’s my account before and after the robbery.

The hackers had moved my content to a new account, @javier.typeshi, stripped of my profile photo and description, ironically adding the text “meta official”.

The profile picture in that account belongs to a man also named Javier Arce. He was a journalist that worked for @azcentral who sadly passed away from stomach cancer last month.

Before turning to Twitter for help (where I was flooded with recovery scams), I created a new account to request my content back. They never responded. I knew the chances were pretty low, and that they would probably try to extort me, but hey I had to ask.

The Investigation

Ok, before I move on and tell you about the new owner of the account, let’s do some conspirancy talk and let me explain how I think my account was stolen.

My account was well-protected with 2FA and linked to a unique, private email address that I’d never shared. I use 1Password and am extremely careful about security. I’ve never entered my Instagram credentials on any third-party websites or apps, nor have I ever shared 2FA codes.

On the day of the event, I received no email or phone notification about any unusual access attempts. So here’s what I believe it happened: it wasn’t a phising attack, it was somebody from inside the company.

This wouldn’t be unprecedented. Meta has previously fired employees for hacking user accounts, and there’s a thriving black market for usernames on forums like oguser.com

The New Owner

Back to the story. Let me tell you about the new account owner. His name is Javier “Jay” Sang. Looking at the tagged photos, he seems to be the founder and CEO of a label called Rebel Music.

And do you remember how I take a screenshot of every account that ask me to sell or change my username? Jay did that in April this year. It seems he may have sought alternative means after I didn’t respond to his request lol

Current Status

As for the current situation: so far, I’ve regained control of the renamed account with all my content and messages, but I still haven’t recovered my original username.

I’m receiving help from an Instagram employee, and through my network of friends and their connections I’ve made contact with other folks at the company who have expressed interest in my case and offered their assistance. I’m very grateful for that.

In fact, I doubt I would have been able to recover my content without those connections at the company. This highlights a serious issue that Instagram and Meta need to address in their account recovery process.

And I’m not the only person with this problem. A few days ago, I learned that @joao, another long-time user, also lost his Instagram handle in a similar way last year, and he still hasn’t heard back from Instagram.

For reasons unknown to me, regaining access to my content was easy, but reclaiming my original username is much harder. And while I’m optimistic about getting my old username back, I’m sure this won’t be the last hack attempt on my account.

The end. Thanks for reading this far! If you’re wondering how you can help, I’d appreciate it if you shared this thread. And if you know @mosseri, please let him know one of Instagram’s earliest users is frustrated and thinking of leaving.

Good News

Hey, guess what? I’m back on Instagram! Huge thanks to everyone who helped me recover my account, shared or liked this thread, or reached out to me over these past few days!

While sadly I can’t help others recover their accounts or ask the people who assisted me (since they don’t work in support), I hope this thread gives some visibility to the issue and encourages others to share their stories.

To me, all of this is a perfect reminder of the importance of controlling your content and building networks outside the reach of proprietary platforms.

There’s an excellent post by Molly White about POSSE (Publish on your Own Site, Syndicate Elsewhere) that I encourage everyone to read and share.

And if you don’t have a blog, consider starting one today! Creating a blog is easier than ever, and it’s one of the best ways to control your content, share your ideas, and build meaningful networks outside of traditional platforms.

For me, I’ll keep posting stories on Instagram and connecting with my friends there, but I’ll also be doubling down on publishing on my personal blog and on the Fediverse.

See you there!