Social Media Hacking: What UK Businesses Face

Social media hacking is the takeover of a social media account by someone without the owner’s permission, usually through a phishing message or a reused password. Action Fraud received 35,434 reports of hacked social media and email accounts in 2024. ProfileTree, a Belfast agency that manages social media for businesses, explains how takeovers happen and how to recover.

Social media hacking statistics for UK businesses

The UK figures show account takeovers rising sharply, while many small firms still protect their accounts with a password alone. For a business owner, the useful figures are the ones collected by public bodies, because they are counted the same way every year and can be checked. They also show why account security belongs inside any plan for social media marketing Belfast businesses put their budget behind.

This short video sets out the scale of the problem before the figures below.

Action Fraud reports on hacked social media and email accounts

Action Fraud, the national reporting centre for fraud and cybercrime in England, Wales and Northern Ireland, recorded 35,434 reports of social media and email hacking in 2024, compared with 22,530 in 2023. That is a rise of more than half in a single year. Victims lost nearly £1 million to the people who took over their accounts, according to the Action Fraud figures published in March 2025.

Those numbers only count people who reported the crime. Many business owners recover an account, or give up on it, without telling anyone, so the real level of social media hacking in the UK is higher than the reports show.

What the Cyber Security Breaches Survey shows for small firms

The government’s Cyber Security Breaches Survey 2025/26, published on 30 April 2026, found that 43 per cent of UK businesses had a cyber security breach or attack in the previous 12 months. The rate was 42 per cent for micro businesses (one to nine staff) and 46 per cent for small businesses (10 to 49 staff).

Phishing, meaning a fake message designed to trick someone into handing over a password or clicking a harmful link, was the most common type of attack and affected 38 per cent of businesses. Only 43 per cent of micro businesses required two-factor authentication, a second check beyond the password, although that was up from 35 per cent the year before. For a small firm, that gap is where most account takeovers begin.

Scam losses that start on social media

The clearest large-scale figures come from the United States, where the Federal Trade Commission collects scam reports nationally. Its April 2026 release reported losses of $2.1 billion in 2025 from scams that started on social media, an eightfold rise since 2020, and nearly 30 per cent of people who lost money to any scam said it began there.

The FTC total covers scams of every kind that began on social media, and account takeover is only one part of it. The two connect, though. A hacked business account gives a scammer a page that customers already trust, and that trust is what makes the scam work.

How business social media accounts are taken over

Most social media hacking relies on a person handing over access without realising it, with technical attacks playing a smaller part. Each method below has a matching defence, which is why it pays to know which one you are facing.

The video below walks through the common methods in a few minutes.

Phishing messages that copy the platform

The most common attack on business pages is a message that appears to come from Meta or LinkedIn. It usually claims a post breaks copyright rules or that the page will be disabled within 24 hours, and it links to a copy of the login page. Anyone who signs in there gives the attacker their password, and often their two-factor code as well.

Spelling mistakes used to give these messages away. Attackers now write fluent, well-formatted copy, so the safer test is the address: check the sender and the web address of any link, and go to the platform directly from your own browser before acting on a warning.

Session hijacking after a password change

When you sign in to Facebook or Instagram, the platform stores a session token, a small file in your browser that tells the site you are already logged in. If malware on your device or an unsecured public Wi-Fi network lets an attacker copy that token, they can use the account without your password or your two-factor code.

This is why changing the password does not always remove an intruder. The token stays valid until the session ends, so you also have to log out of every active session from the platform’s security settings.

Chain hacking and requests for one-time passcodes

Action Fraud describes a method it calls on-platform chain hacking. The attacker takes over one account, then messages that person’s friends or followers while pretending to be them, asking each one to forward a one-time passcode. That code is in fact the login code for the friend’s own account, and the chain continues.

For a business, the risk runs in both directions. A staff member’s personal account can be used to reach the company page, and a hacked company page can reach every customer who follows it.

Reused passwords and credential stuffing

Credential stuffing is the automated testing of usernames and passwords leaked from one website against many others. If the password on your Facebook account is the same one you used on a site that was breached years ago, this form of social media hacking needs no trickery at all. A password manager, which creates and stores a different password for every account, closes this route almost entirely.

What a hacked account costs a business

The cost of social media hacking to a business goes beyond the time spent getting the account back. Customers who receive messages from the hacked page may assume the business sent them, and some will act on them before a warning goes out.

Lost access and impersonation of the brand

An attacker who takes over a page usually changes the email address and phone number on the account first, which locks the owner out of the normal recovery route. They then use the page’s reputation: fake giveaways, requests for payment, links to phishing sites, or offers that look like the business’s own. Every hour of access gives them more time to reach your followers.

Trust takes longer to repair than access. A business with a consistent, recognisable voice on its channels can warn its audience quickly, because followers know what a genuine post looks like. Our article on the warning signs of social media scams shows what those fake messages tend to look like.

Customer data held in inboxes and WhatsApp Business

Many UK and Irish small firms take enquiries, bookings and orders through Facebook Messenger, Instagram direct messages and WhatsApp Business. Those inboxes hold names, phone numbers, addresses and order details. If an attacker can read them, social media hacking becomes a data protection issue as well as a marketing one, because the incident may be a personal data breach under UK GDPR, which brings duties covered later in this guide. Our guide to data privacy in social media marketing explains what a business should and should not keep in those inboxes.

Securing business accounts against social media hacking

A few settings, applied to every account the business uses, close off most of the routes described above. The work takes an afternoon, and a short review each quarter keeps it in place. Our guide to social media security covers privacy settings in more detail, and the steps below focus on the business account itself.

Two-step verification methods compared

Two-step verification (also called two-factor authentication) asks for a second proof of identity after the password. The methods differ a great deal in how well they hold up against social media hacking.

For most small businesses, an authenticator app on the owner’s phone is the practical choice. Text message codes are better than nothing, but a business that relies on them should move to an app as soon as it can.

Individual roles in place of a shared password

The biggest risk for a team is one login shared between several people. When someone leaves, or their phone is compromised, the whole page is exposed, and nobody can tell who did what.

Meta Business Suite lets you give each person their own access with only the permissions they need, and remove it in a minute when they leave. LinkedIn page admin roles work the same way, so most staff can post as content admins without holding full control. Getting a team comfortable with these settings is partly a training job, and our digital training covers account management for small business teams.

Quarterly checks on connected apps and active sessions

Old scheduling tools and forgotten integrations stay connected to an account long after anyone uses them, and each one is another way in. Every three months, open the security settings on each platform and remove any app the business no longer uses. While you are there, end any session on a device you do not recognise.

Export a copy of the account’s data at the same time. It will not stop an attack, but it means the business keeps its posts and follower information if an account is lost for good.

What to do in the first hour after social media hacking

Speed matters most in the first hour, because the attacker is usually still changing settings and messaging followers. Work through the steps below in order.

This video shows the recovery steps on screen.

Start with your email. Open the email account linked to the social profile directly, not through any link you were sent, and look for a message saying the email address or password was changed. Most platforms include a link to reverse the change, and using it quickly often ends the incident. Then change the email password and turn on two-step verification there, because whoever controls the email can reset every account linked to it.

Next, use the platform’s own recovery route. Meta’s recovery pages are at facebook.com/hacked and instagram.com/hacked, and LinkedIn handles recovery through its help centre. Never pay a “recovery service” that contacts you through comments or direct messages, as these are scams that take a fee and disappear.

Once you are back in, sign out of all devices and move two-step verification to an app such as Google Authenticator. Review the list of people and apps with access to the page before you post anything. Finally, check what was posted or sent while the attacker had control, and tell your followers plainly not to act on those messages.

UK and Irish law and reporting duties

Social media hacking is a criminal offence in both the UK and Ireland, and a business that held customer data on the account may also have a duty to report the breach. What follows is general information, so take legal advice on your own situation.

In the UK, the Computer Misuse Act 1990 makes it an offence to access a computer system without permission, and that covers social media accounts. It applies even if the person already knew the password. In Ireland, the Criminal Justice (Offences Relating to Information Systems) Act 2017 makes unauthorised access to an information system an offence, with a maximum of five years’ imprisonment for the most serious cases.

Report the crime to Action Fraud if you are in England, Wales or Northern Ireland, and tell your bank straight away if money or payment details were involved. In the Republic of Ireland, report it to An Garda Síochána, whose National Cyber Crime Bureau handles cybercrime.

If the attacker could see personal data, such as customer names and order histories in the inbox, UK GDPR requires the business to tell the Information Commissioner’s Office within 72 hours of becoming aware of the breach, unless it is unlikely to put people’s rights at risk. Irish businesses report to the Data Protection Commission on the same timescale. Keep a written record of when you noticed the problem and what the attacker could reach, because it supports any report you make.

Keeping your business social media secure with ProfileTree

The next step for most businesses is a half-day review of who has access to each account and which two-step method each one uses. That review protects the marketing work the business has already done, and it is the first thing to fix before any new campaign.

“ProfileTree does not sell paid advertising, and the social media marketing we do for businesses in Northern Ireland is built to keep working after the invoice is paid. A page only does that while the business still controls it, which makes account security part of the marketing work and not something to deal with after an attack,” says Ciaran Connolly, founder of ProfileTree.

ProfileTree is a Belfast web design and digital marketing agency, founded in 2011 and based at the McSweeney Centre. Our social media team works with businesses across Ireland and Great Britain on organic social media, and an access review like the one above is a sensible place to begin. To talk about your own accounts, see our social media marketing services for businesses across the UK and Ireland.

Frequently asked questions