What to Do When Your Restaurant's Instagram Gets Hacked

The message usually comes in late. It looks official. Something about a copyright claim on one of your food videos, or a warning that your account will be deleted unless you confirm it, with a link and a countdown. Whoever is covering the phone that night taps it, enters the password because it looks like the normal login screen, and then types in the six-digit code that lands on their phone a second later. That is it. By morning the email on the account has been changed, the password has been changed, and your restaurant's Instagram is posting crypto screenshots to four thousand people who used to look up your hours there.

If your restaurant Instagram is hacked, the first hour is worth more than the next two weeks. Here is what to actually do, in order, and what to stop doing.

Almost every one of these starts with a link and a code

It is rarely a password someone guessed. It is a phishing message — a DM from an account that looks verified, or an email that looks like it came from Meta — that sends you to a fake login page. You enter the password. The fake page then asks for the two-factor code, and because you asked for that code yourself thirty seconds earlier, it feels legitimate. You hand it over.

Knowing this matters, because it tells you where the damage is. If one person on your staff gave up a code, the password is gone and so is two-factor. If that same password is also your email password, you have a much bigger problem than Instagram.

Start with the email account, not Instagram

Before you touch anything else, get into the email address the Instagram account is attached to and change that password. Then check its filters and forwarding rules. A common move is to set a rule that auto-deletes anything from Instagram, so you never see the "your email was changed" notice sitting in your inbox.

If you still control that email, you are in a much better position. Instagram sends a message when an account's email is changed, and that message contains a way to reverse it. People miss it because it is buried under receipts and reservation notifications. Search the inbox and the trash.

While you are in there, change the password on any account that shared the same password. Your Facebook page, your Google account, your online ordering back end. Attackers try the same password everywhere.

Report it inside the app, not through whoever slid into your DMs

Instagram's account recovery runs through its own help and login flows. You start a login attempt, say you need more help, and follow the identity steps it gives you. If your account has photos or videos of a real person in them, it may ask for a video selfie to confirm you are that person. That is a legitimate step.

What is not legitimate: the accounts that will start DMing you and your staff within a day of the hack offering to recover it for a few hundred dollars. They find hacked accounts by watching for the spam posts. Some of them are the same people who took it. Nobody can pull strings inside Meta on your behalf, and paying them gets you nothing but a second set of people with your information.

Recovery can take a while and sometimes it does not work. I am not going to tell you a timeline, because nobody honest can.

Keep your customers in the loop somewhere they will see it

While the account is out of your hands, people are still messaging it to ask if you are open. Some of them are getting replies from the person who took it.

Post on your Facebook page, if you have one, that the Instagram account is compromised and nothing coming from it is from you. Put a sign at the register. If you have a second account — a catering account, a personal account, your chef's account — use it. Tell people the phone number, because that still works. A short, plain note does the job: "Our Instagram was hacked. We're working on it. Call us at the restaurant for hours and orders."

Do not let it go silent for a week with no explanation anywhere. That is when regulars assume you closed.

Lock it down differently the second time

Once you are back in, assume the old setup is the thing that failed.

Use an authenticator app for two-factor instead of SMS. Save the backup codes somewhere physical. Change the recovery email to one that only the owner controls — not the general info@ inbox that four people and a former host still have the password to.

Then look at who has access. Most restaurants I work with have the login shared by text message with whoever happened to be posting that month. That is how you end up with a line cook from two years ago still holding the password. Move the account into a Business Manager setup where people get roles, not the password, and you can pull access the day someone leaves. If an agency is involved, they should never be holding the only credentials. That is covered in more depth in the post about giving an agency access.

One more thing: tell your staff what the phishing looks like. The copyright warning. The "verification" offer. The DM from an account with a blue check that is actually just a check in the display name. If everyone with the password knows what the trap looks like, it does not work.

This is cheaper to prevent than to fix

There is no insurance on a social account. The followers you built over four years are not stored anywhere you control, and there is no guaranteed way to get them back. An hour spent on two-factor and proper roles is worth more than any recovery attempt.

If you want someone handling the posting, the access, and the security setup so it is not one more thing sitting on you at eleven at night, you can book a call with us and we will walk through how your accounts are set up right now. Or call the shop at (313) 633-5714.