Instagram hacked: changed email, lost access and recovery steps

Secure the account that controls recovery

Before focusing only on Instagram, consider your linked email. If an attacker can read reset messages, a recovered social account may be taken over again. Open your email provider directly on a trusted device and review its security options. Use a unique password and check for unfamiliar recovery details or sessions.

Write down which accounts may be affected. If you reused the same password elsewhere, include those accounts in your security review. Do not continue signing in through links sent by an unknown “support agent”.

Record what changed

Build a compact record: the username before and after the takeover, the last normal access, the first suspicious message and which contact details changed. Keep genuine Instagram security emails. Note whether any device remains logged in and what controls are available there.

This record supports a coherent account of events. Do not include passwords or current verification codes. If you ask someone for help, send only the information required for the assessment through a verified contact route.

If the email and phone number were changed

Record the former contact details, the last known username and the timing of the changes. Check whether any device is still signed in. Describe exactly where recovery stops: an unreachable code, an old email request, a pending check or a suspension after the takeover.

We assess additional recovery and escalation routes for hacked accounts. An enquiry does not require passwords, codes or identity documents. Agencies can use our client-account coordination guidance.

Use the official recovery flow

Type instagram.com/hacked into the address bar or use the recovery controls provided by the Instagram app. Follow the prompts that match your situation. Ownership checks may differ from one account to another; complete them directly on the platform.

Meta’s official support update describes adaptive recovery flows and simpler verification. That means the exact steps can vary. A missing button from an old screenshot does not necessarily mean recovery is impossible. Use the flow currently provided to your account and keep copies of its messages.

Handle the business interruption

If the account represents a brand, tell your team what happened through an established channel. Assign one person to coordinate the timeline so information does not become contradictory. Preserve scheduled campaign details and record messages or posts you did not create.

If an attacker has contacted customers, consider a clear notice on another verified business channel. Keep the notice limited to confirmed facts. Do not publish private recovery information, case references or screenshots containing personal details.

Complete the security review after recovery

Once access is restored, check login activity, profile details and recovery contact information. Meta’s Security Checkup guidance recommends reviewing these areas and enabling two-factor authentication. Use the current security settings available to your account.

• Remove unfamiliar sessions and review connected access.
• Confirm the email and phone number are yours.
• Use a unique password and enable two-factor authentication.
• Keep backup codes somewhere private and secure.
• Review posts, messages and profile changes made during the takeover.

If the usual recovery steps do not restore access, Kahyalar Solutions assesses additional recovery and escalation channels for your account. Send your username and a brief description for a free assessment.

Support for your specific account

Kahyalar Solutions assesses the issue and agrees the work before you commission a service. Read the scope and information we need, and the payment and refund conditions.