What to Do If Your Business Instagram Gets Hacked

For a lot of businesses in Nairobi, the business is the Instagram account. No website, no separate system — just a phone, a camera, and a following that trusts you enough to send payment before anything ships. So when that account gets hacked, it isn't a minor inconvenience. It can feel like the business itself just disappeared.

Here's what to do, in order, if it happens to you.

1. Don't panic-message everyone yet. Your first instinct might be to post from another account warning customers immediately. Do that after step 2 — you want your warning to include real information, not just "something's wrong."

2. Try Instagram's official recovery flow first. Go to the login page, choose "Forgotten password," and try your email or phone number. If the hacker changed your linked email, Instagram has a specific "my account was hacked" reporting flow — search "Instagram hacked account" inside the app's Help Center, not through a random link someone sends you (scammers impersonate this exact process).

3. Report it as compromised, not just "forgot password." Instagram treats these differently. Reporting it as hacked gets you into a review queue that can recover accounts a simple password reset can't.

4. Warn your customers from a channel the hacker doesn't control. WhatsApp broadcast, a Facebook post, even a physical sign if you have a shop — say plainly that your Instagram was compromised and you're recovering it, and that any payment requests coming from that account right now are not from you.

5. Once recovered, change everything. New password, and turn on two-factor authentication this time — this is usually what let the hack happen in the first place.

6. Think about who else has access. If a staff member had the login and has since left, or if the password was shared loosely, this is the moment to tighten that up for good.

The uncomfortable truth: recovery isn't always fast, and it isn't always guaranteed. That's exactly why the better move is preventing this before it happens — a business account with proper MFA and a real account-recovery plan rarely ends up in this situation at all.