You want to log in – wrong password. Profile picture gone. Email address changed. Meta doesn't respond. Welcome to probably the most stressful news of the day: your Instagram has been hacked. Take a deep breath – and work through the following steps one by one. Exactly these "Can you help?" requests regularly land on our desk, from freelancers and SMEs to content creators for whom the channel is existential.

And almost always, the hack isn't the problem, but the aftermath. Amidst bad advice, countless forms, and "friends who also had this happen once," what matters most is often lost: calm, structure, and a methodical approach. That is exactly what we provide you with here – from the practical experience of a social media agency that manages Meta accounts on a daily basis.

Instagram hacked – what should you do now?

Before you panic-google whether your profile is "lost forever": the first step leads to instagram.com/hacked, Instagram's official page for compromised accounts. There, you check whether your account has been compromised and start the recovery process directly. Then, you proceed systematically:

• Change passwords. All of them linked to the account – Facebook, Meta Business Manager, Gmail, or Outlook.

• Kick out devices. Remove unknown devices from active login sessions.

• Enable two-factor authentication – via an app. Use an authenticator (e.g. Google Authenticator), not SMS or WhatsApp – it is very likely that those got you into this mess in the first place.

• Inform your team. Anyone with access to the account needs to be informed. Frantic solo actions ("I'll quickly post a warning") usually cause more harm than good.

How do I actually reach Meta Support?

Meta Support is – politely put – idiosyncratic. There are hundreds of forms, but only a few paths actually lead to your goal. The best route is via Meta Business Manager: there, you open a ticket in the support section or connect via chat.

Meta responds even faster if you submit a report via an active advertising account. We see this every day: those who run ads get priority. It feels unfair, but it's a fact. As a Meta Blueprint-certified agency – and due to the not-insignificant amount of ad spend we manage for clients on Meta – we have a direct contact person and can act faster. But we know: not everyone has this, and this feature costs money for us as well.

That leaves the final route: the identity verification form. Meta requires a selfie with a code – sounds absurd, but works astonishingly often. Make sure to have your ID and the email address originally linked to the account ready.

How do I keep my Meta account permanently secure?

After a hack, you want one thing above all: never to end up here again. Make sure your account is as secure as your online banking – or even more secure. Use an authenticator app instead of SMS, regularly check admin permissions in Business Manager, remove former partners or employees, and choose a password you can't remember (and neither can anyone else).

Even better: have the account audited technically on a regular basis – access rights, API connections, ad account access. That costs less time than a lost channel will cost you. Exactly such security checks are what we handle as part of our consulting.

What you should definitely not do during an Instagram hack

When your account has been hacked, desperation is a poor advisor. Three things you should avoid:

• No dubious "recovery agencies" promising to retrieve the account in 24 hours – many of them are scams themselves.

• Do not give up too early. Even after weeks, an account can often still be recovered.

• Do not create a new account. By doing so, you make it almost impossible for Meta to restore the old one.

Staying secure long-term – why cyber insurance makes sense

An Instagram hack rarely affects just Instagram. Usually, Facebook, WhatsApp Business, or ad accounts are also involved. Therefore, review all access rights once a quarter – who is an admin, who is a partner, who is an employee? Use the central access via business.facebook.com/settings and set up a backup admin who retains access in an emergency.

And honestly, from our own experience: solid cyber security insurance is worth its weight in gold. Among other things, it covers the costs for reputable service providers – partners like us – who support you in an emergency. Our partner, Rosenstatter Versicherung, provides competent and straightforward advice on this. This is not paid advertising, but a genuine recommendation – I pay for this insurance myself.

Because yes: even a specialised agency can be hacked, with affected client accounts and Meta access blocked for weeks. That was my personal nightmare – and that is precisely why having cover helps you to act calmly in an emergency instead of reacting in a panic. Security isn't an optional extra. It is part of your brand presence – and ultimately saves money, nerves, and trust.