Business Social Media Account Hacked? What to Do Now

If your business social media account has been hacked, start the platform’s official recovery process immediately, secure the email address and two-factor authentication linked to the account, and check any connected ad accounts for unauthorized spending. While recovery is underway, warn followers through your other channels not to click links or send money. Once you’re back in, remove what the attacker posted, revoke unknown app and admin access, and publish a short statement.

Speed matters, but so does using the right channels, whether it’s a hacked Facebook Page, an Instagram business account hacked through a phishing message, or an X or LinkedIn takeover. Scammers target hacked businesses with fake “recovery experts,” so stick to the platforms’ own help pages throughout.

The first hour: what to do, in order

1. Try to log in and change the password. If you still have access, change the password, sign out of all other sessions and turn on two-factor authentication right away.
2. Secure the email account. If the attacker has access to the email tied to the social account, they can reset any password you set. Change that email password first, check its recovery options and forwarding rules, and turn on two-factor authentication.
3. Start official recovery if you’re locked out. Use the platform links in the next section.
4. Protect your money. Check linked ad accounts and saved payment methods. If you see charges you didn’t make, contact your bank or card provider and the platform’s ads support.
5. Warn your audience through your website, email list and other social accounts.
6. Tell your team. Make sure nobody posts from other accounts, replies to the attacker, or pays anyone claiming they can restore access.

Save screenshots of what the attacker posted, messages they sent, login alerts and any emails about changed passwords or contact details. You may need them for recovery, for your bank, or for a police report.

Recovery routes for each platform

Each platform has its own process. Start from its official help center rather than a search result, since fake support pages are common.

Platform	Where to start	What to expect
Facebook	facebook.com/hacked, ideally from a device you’ve logged in with before	Guided steps to secure the account, change the password and review recent activity. Meta’s help centers also cover recovery for Instagram and Threads accounts linked to the same Accounts Center.
Instagram	instagram.com/hacked	A login link or security code sent to the email or phone on file. Instagram may ask you to verify your identity, for example with a video selfie.
X	The password reset page, then the hacked or compromised account form in X’s Help Center	If a password reset doesn’t work, submit the form using the email address associated with the account.
LinkedIn	The “report a compromised account” form in LinkedIn Help	You’ll provide the account’s email, phone number and profile URL. Company Pages are managed through personal admin accounts, so recover the admin’s profile first.
TikTok	The login screen’s help option, then the hacked account route, or TikTok’s support pages	In-app support guides you through recovery. Ignore anyone offering “TikTok support” in comments or direct messages.

How to recover a hacked Facebook Page

A Facebook Page doesn’t have its own password. It’s controlled through the personal profiles that have access to it, so a hacked Facebook Page usually means an admin’s personal account was taken over, or an attacker was given access and removed everyone else.

1. Recover the admin’s personal account at facebook.com/hacked, following Meta’s steps to secure it.
2. Review Page access. From a secured admin profile, open the Page’s settings, check who has access and remove anyone you don’t recognize.
3. Check your business portfolio. If the Page is managed through a Meta business portfolio, review the people, partners and ad accounts listed there too.
4. If no admin can get back in, use the hacked Page and business account options in Meta’s Business Help Center and provide the information it asks for.

If you search “Facebook business Page hacked”, you’ll also find ads and posts from so-called recovery services. Ignore them and use only Meta’s own help pages.

Once you’re back in: clean up

1. Change the password again and log out every other session.
2. Turn on two-factor authentication, using an authenticator app or security key rather than text messages where the platform allows.
3. Check contact details. Make sure the email address and phone number on the account are yours, and remove any the attacker added.
4. Review admins and roles. Remove anyone you don’t recognize from Page roles, business portfolios and ad accounts.
5. Revoke third-party app access. Remove apps and integrations you don’t recognize or no longer use. A compromised scheduling tool or old app can be the way attackers got in.
6. Delete malicious posts, stories and messages. Screenshot them first, then delete. Check scheduled posts and draft ads too.
7. Review ad accounts and billing. Pause or delete campaigns you didn’t create and remove unknown payment methods.

Warn followers and customers

If the attacker is posting scams, crypto promotions or offensive content, your followers need to hear from you quickly. Post a short notice on the channels you still control, your website and your email list.

Our Instagram account was accessed by someone else earlier today. Please don’t click links, reply to messages or send money through that account until we confirm it’s secure. We’re working with Instagram to restore access and will update you here.

Keep it factual and calm. You don’t need to explain how it happened yet. Our guide on writing a holding statement covers this kind of early message in more detail.

Report fake accounts and look-alikes

Attackers sometimes create copycat accounts, or rename your hacked account and set up a new one in your name. Report any account pretending to be your business through the platform’s impersonation report. Ask followers to report them too, and to tell you if they receive suspicious messages. Our guide on what to do if someone is impersonating you online covers the steps across platforms.

A worked example

This is an illustrative scenario, not a real client.

A family-owned bakery’s Instagram account starts posting giveaways asking followers to “claim a prize” through a link. The owner can’t log in, and the email address on the account has been changed.

1. Recovery: she uses instagram.com/hacked, follows the prompts and verifies her identity with a video selfie.
2. Warning: while waiting, she posts a notice on the bakery’s Facebook Page and website, and emails its customer list.
3. Money: she checks the linked Meta ad account and finds a campaign she didn’t create. She pauses it and contacts her bank about the charges.
4. Cleanup: once back in, she deletes the scam posts, removes an unknown email address, enables an authenticator app and revokes access for an old contest app.
5. Statement: she posts a short update explaining the account is secure and thanking customers who flagged the scam.

Recovery times vary by platform and case. In this example, the quick warning meant few customers engaged with the scam, and the business looked responsible rather than careless.

Post-incident statement

Once you’re back in control, post a short update on the recovered account and any channels where you warned people.

We’ve regained control of our Instagram account. Posts and messages sent between Tuesday and Thursday were not from us, and we’ve removed them. If you clicked a link or shared personal or payment details during that time, please contact your bank and change any passwords you used. We’ve strengthened our account security, and we’re sorry for the confusion.

If customers lost money or data, the response needs more care, and possibly legal advice about notification obligations. Our guide on communicating a data breach covers that situation.

How to prevent the next takeover

• Use a password manager and a unique, strong password for every account, including the linked email.
• Turn on two-factor authentication everywhere, using an authenticator app or security key where possible.
• Use business tools for access. Manage Facebook and Instagram through a Meta business portfolio, and give staff and agencies roles there rather than sharing passwords.
• Keep at least two trusted admins with secure accounts, so one compromised person doesn’t lock out the business.
• Remove access promptly when staff or agencies leave.
• Train the team on phishing. Many takeovers start with a fake “copyright violation” or “account suspension” message that leads to a fake login page.
• Review connected apps a few times a year and remove anything you don’t use.

Write these steps into your crisis communication plan, with named people responsible for recovery, statements and customer questions.

Common mistakes

• Paying a “recovery service.” Scammers target exactly this moment.
• Securing the social account but not the email. The attacker can simply reset the password again.
• Staying silent. Customers who fall for a scam posted from your account will blame you if you didn’t warn them.
• Forgetting the ad account. Unauthorized spend can continue long after you regain the profile.

When to get help

Most takeovers can be handled with the platform’s own tools. It’s worth getting help when a hack has spread offensive content, attracted media attention or led customers to lose money. Our crisis management team can help with statements, customer communication and cleaning up what appears in search afterward.

Frequently asked questions

How long does it take to recover a hacked business social media account?

It varies by platform and by how much the attacker changed. Some accounts are recovered within hours using a login link; others take days or longer if identity checks or manual reviews are needed. No one can promise a set timeframe.

Can I get my followers back if the hacker deleted my account?

It depends on the platform and how long ago the account was deleted. Some platforms keep deleted accounts for a period before permanent removal, so start recovery immediately through the official help center.

Should I create a new account while I wait?

Only if recovery clearly fails. A second account can split your audience and confuse customers. In the short term, use your website, email list and other platforms to communicate.

Will the platform refund money spent on fraudulent ads?

It depends on the platform’s policies and the circumstances. Report unauthorized charges to the platform’s ads support and to your bank or card provider as soon as you notice them.