Hacked, Flagged, Restricted: The untold story of social media breaches against users

When Adewumi Damilola, an aspirant of University of Ilorin, woke up to her normal routine of scouring through her social media accounts in 2023, everything seemed okay. A few minutes later, she noticed a struggle in accessing her Whatsapp with a spam message popping on the screen.

At this point, she realized that her account had been hacked, leaving her confused and devastated. “It was not a good time at that hour because I was processing my admissions. Every update I get about it comes from WhatsApp, and most of my contacts are saved in the app.”

For many, social media platforms go beyond a space for entertainment, interaction or communication. It has become a lifeline for business transactions, academic opportunities and professional reputation.

Fitting into her new reality, she opted for Facebook to remain connected with friends who are also seeking admission in the same school. But this alternative yielded little to no effect compared to her conventional Whatsapp, as she was left helpless and devastated.

The struggle of privacy breaches is not unique to students. The menace mirrors a general plight ravaging Nigerians, as several people experienced one hack or the other across various social media platforms, casting a toll on academics, professionals, and economic life of the victims. 

In the first quarter of 2023, Nigeria experienced a 64 percent surge in data breaches among users amounting to 82,000 cases compared to 5,000 in the previous quarter. Despite efforts to mitigate the fraudulent practice, the number keeps growing. 

More Victims, More Stories 

For Dayo Samuel, a Mass Communication student from the Federal Polytechnic Offa, his experience was the case of Facebook deactivation. He noticed the restriction while trying to access his account despite several attempts. 

Just like Damilola, Samuel did not receive any notification, message or call before the deactivation. The aftermath of the disconnection is harmful to him, further impacting the output of his entrepreneur journey as he was unable to connect with his customers.

On the part of Francis Tochukwu, the loss still haunts him, as he can vividly remember how he lost his Instagram account to scammers. 

Tochukwu stressed that the incident happened to him like a nightmare. A few days before his experience, he narrated that he was receiving repeated notifications that he needed to change his password which he ignored due to safety.

Although he desisted from heeding to the spam notification on the basis of security reasons, the worst still happened. He explained that these scammers succeeded in taking over his account while leaving him inaccessible. 

Silenced Via Social Media—A War Against Freedom of Expression 

On a sunny afternoon, Mrs Adesola Adunni, a communication expert, was working on her laptop device when she suddenly noticed a pop-up, which later turned out to be an attempt to access her Facebook account. She would later explain the reasons behind her experience. 

According to her, the notification persisted for three days consecutively but “all thanks to the two step verification flow and email link. If not, my account would have been gone.” 

Speaking further, she recalled commenting on a post shared by a political candidate during the 2023 fiercely contested election, a few days before an attempt on her Facebook account which failed due to heavy security measures. 

“It was a few days after this comment which sparked backlash and insults by the candidate’s staunch supporters that an attempt towards my account was made,” Mrs Adunni told said.

After escaping the first encounter, Mrs Adunni received another shocking notification on her Facebook in January 2024. This time her account was flagged. 

Out of curiosity, she uneasily refreshed her Facebook page. Unfortunately for her, the same notification persisted, stating that her account had been flagged for fraudulent activity, thereby bridging the platform’s community standards. 

She was now faced with a dilemma. Under the flagged notification, an option to either chat or appeal was made available. She clicked on the appeal option, and answered a series of questions as requested. 

Mrs Adunni felt relieved after undergoing the first process. A few hours later she was sent another notification more disturbing than the former one. “I was given an ultimatum of 180 days to respond or my account will be permanently disabled,” she recounted, stressing that her previous response was not received. 

Mrs Adunni’s encounter was a unique one involving press freedom, censorship, backlashes and speech restrictions on social media. 

Just like the 2023 struggle, Mrs Adunni experienced her second encounter a few days after she made comments related to the advocacy of the implementation of Sharia Law in the South-East. She narrated that she shared a post on Facebook, correcting some misconceptions surrounding the agitation in the Yoruba region. 

In reaction to her post, she experienced a similar ordeal as the first time. Facebook flagged her account for fraud, alleging that she has bridged the community standards again. Mrs

Adunni noted that the struggle with her account was as a result of mass reporting of her Facebook page. 

Recall that in 2024, there was a move towards the establishment of a Sharia Court in Oyo State and other Southeastern states of Nigeria. Despite accumulating opposition from some Nigerians who perceived it as unnecessary, Sheikh Imran, the leader of the Jama’atu Ta’awunli Muslimeen worldwide, dismissed the resistance as baseless while arguing that the Sharia law was recognised in the Nigerian constitution. 

“What happens when the account suddenly disappears?” Mrs Adduni questioned. “It was like the world was coming to an end. The account which she had built for more than 10 years, had inversely become part of her professional Curriculum Vitae (CV),” she disclosed. 

Loss Beyond the Screen 

For many victims, the impact of social media privacy breaches go beyond the feeling of losing access to social media handles. It disrupts their personal life, education, business as well as job capability of the victims. 

For Tochukwu, his experience travelled beyond the borderline of mere loss as he has built connections both nationally and internationally through the account. He said that his Instagram account was as important as anything to him. He also noted that the

account connected him with people online. 

Not just that, he lost contacts of friends and colleagues who he claimed to have engaged in unfinished conversation before his account was compromised. 

Despite the need to open a new account, he has reluctantly refused, reminiscing on the pain of losing the first account he had worked so hard to build. 

“I always dream of furthering my studies abroad and this started coming to realisation when I met some colleagues on Instagram who promised to assist me with the application that will help me. But this came to an end when I lost my Instagram account to an internet theft. I was totally cut off from all my connections. This missing opportunity still haunts me up to date.” 

Damilola, another victim of internet theft who was separated from her accounts for months before recovery said, “I was processing my university admission when my WhatsApp account was hacked. I save most of my contacts on my WhatsApp.

When Damilola’s WhatsApp account was spammed, she felt like giving up on the admission process because that was the important moment when she needed an update about the admission. What broke her most was that the alternative she had, which was Facebook, was not as effective as WhatsApp. 

Similarly, another user who is a pastor (who preferred to stay anonymous) experienced a similar narrative when his Facebook account was hacked and used in sharing nude pictures and videos. 

When this happened, he said, he was opportuned to recover the account but he could not continue using it due to the impact of the illicit posts towards his personality. “You can just imagine what people will be thinking when they see those videos on my pages,” he lamented 

During an interview, Ikemsinachi Chukwuemeka, a health specialist, pointed to mild anxiety, sense of isolation and even grief as the health implications of privacy breaches on internet users. 

Furthermore, he encourages media users to build real life relationships rather than online connections that can vanish without prior notice or warning. 

“By building strong friendships and support systems outside the online world, we have people to lean on when disruptions happen,” he warned. 

The Dilemma of Account Recovery 

The increase in digitalization of the economy and expansion of social media users across Nigeria have led to the upsurge of cybercriminals. In 2024, the country’s social media users increased by 16% which is up to 36.75 million users from the previous year, data published by DataReportal, a global digital insights company revealed. 

For instance, Instagram had 74% Increase in growth as their users reached 12.4 million Nigerians in January 2024. 

This development has led to the increase of cyberattacks on social media, especially account hacking. This has posed a danger to businesses and individuals, with cybercriminals engaging in activities like identity theft, impersonation, financial fraud, and spreading of misinformation.

In the first quarter of 2023, there was a 64% increase in data breaches resulting in the need to take cybersecurity measures seriously, the report added. As of early 2023, Nigeria had over 82,000 compromised user accounts, marking a 46% increase quarterly. 

Therefore, regaining breached or restricted accounts has been a challenging task for most users due to the tactical and technical process, and time intensiveness involved. 

Like the case of many victims, Francis tried his possible best to recover the account but all efforts were futile. He further attempted to log in with the email used while creating his Instagram account. Yet, his efforts proved abortive. 

Although Damilola was able to recover her account unlike Francis. This was after a month-long trial and continuous attempts. She narrated that regaining the account was tough, as she continued receiving a code to gain full control of her WhatsApp account. 

“I will receive a code to open the WhatsApp account, but after a few days, it will stop again. This process continued for months before the account finally became stable and active,” Damilola narrated. 

For Mrs Adunni, she had to wait for 20 days before the account was recovered after seeking the help of colleagues and friends who introduced her to the Facebook public relations representatives. 

She stressed that the recovery process was not easy at all, spending days with the assistance of someone outside the country. “Just imagine a person without such privileges. This means the account is gone,” she said sympathetically.

 

Legal Punishments, Poor Enforcement 

Cybercrimes (Prohibition, Prevention, etc) Amendment Act, 2024, prohibits the usage of computer and internet for a fraudulent purpose, with punishment readily available for an offender guilty of any of the offenses outlined in the Act. 

Section 22, subsection 3 of the Act prohibits any person to fraudulently impersonate any person or entity, either alive or dead with an intention to gain financial advantage to himself or cause disadvantage to the person so impersonated or some other person. 

The punishments available for the offender upon conviction are seven years imprisonment, or N5,000,000 fine, or both. 

The section reads: “(1) Any person who is engaged in the services of any financial institution, and as a result of his special knowledge commits identity theft of its employer,

staff, service providers and consultants with the intent to defraud is guilty of an offence and upon conviction shall be sentenced to 7 years imprisonment or N5,000,000.00 fine or both”. 

Mr Attairu Haruna, a legal practitioner, argued that the main challenge to the above provisions is the failure to identify who is authorized to access a computer system, and the likelihood of the prosecutions not being able to prove their case based on the standards set by law whenever they charge any person who contravene the law. 

“I think authorization to access internet data should always be written, while spelling out the extent of the authorization.” 

Government, Media Organizations Are Not Immune 

Despite the introduction of Multiple Factor Authentication (MFA), an electronic method devised to protect personal data such as personal identification or financial assets from being assessed by an unauthorized third party. The increasing cases of account breaches on the account of personal users, governments and media organizations has raised concern on the trustability of the 2FA layers. 

Some sources interviewed in this report were victims to one or two breaches of social media accounts despite subjecting the account to the two verification processes aimed at securing accounts from fraudsters. 

On 18th December, 2024, the National Bureau of Statistics, a Nigeria government agency responsible for collecting and disseminating statistical data on Nigeria’s economy, governance, and development, via its X handle revealed that its newly designed account had been hacked, barely two weeks after it was unveiled. 

Evidence gathered from news reports estimated that since the hack on the NBS account, it has not been restored. 

In the same vein, Premium Times, a non-governmental media organization in Nigeria experienced a similar fate in the early hours of February 19, 2025. The media platform’s X account was hacked by unsuspecting attackers despite employing MFA and two steps authentication to secure the account. 

‘Always Protect Your Accounts’—Expert Weighs In 

Latifat Akinwale, a Cybersecurity Analyst, insisted that negligence on the part of the user as well as swaying tactics employed by scammers exposed users to vulnerability.

She argued that users’ refusal to activate extra security layers and usage of weak passwords across multiple platforms can make them vulnerable to internet theft. 

Speaking further, she highlighted the role of mass reporting in account restriction, saying that “Mass reporting is often weaponized to silence or target people unfairly. When several users report an account at once, the system may assume the account is harmful, even if it’s not.” 

Mrs Akinwale advised the vi

ctims to go through the appeal process, provide proper identification if requested and document everything in order to recover their accounts. Reaching out publicly on platforms like Twitter/X can also draw attention and speed up resolution, she suggested. 

According to her, unusual behavior by a user on its genuine account can lead to restriction of social media accounts while suggesting that victims can report cases to appropriate officials while having a viable evidence screenshot. 

“In Nigeria, Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 criminalizes hacking and unauthorized access to accounts. So, victims can report incidents to the Nigeria Police Force Cybercrime Unit, NITDA or EFCC,” she stated. 

In conclusion, she advises that when experiencing delay in response from official bodies as mentioned above, users can resort to legal or regulatory bodies if needed. 

Ikemsinachi Chukwuemeka spoke on the mental effect of social media hacking, and highlighted some of the mental and psychological impacts on users. 

“The impact can range from mild anxiety to a sense of isolation or even grief. Many people use social media as a main source of connection, self-expression, and daily routine. When it’s suddenly taken away, they may feel cut off from their community and identity.” 

Furthermore, he encourages that social media users build real life relationships rather than online connections that can vanish without prior notice or warning. 

“Use social media to strengthen real-life connections, rather than replacing them. By building strong friendships and support systems outside the online world, we have people to lean on when disruptions happen,” he warned.

By: Miracle Akubuo