When Madi Westbrooke checked her email in September 2017, she was greeted with what appeared to be a career milestone: Instagram verification. As a freshman at the University of Alabama, she had spent the past two years vlogging on YouTube about her everyday life in college, amassing over 117,000 subscribers. She was on the brink of making it big, and gaining that coveted checkmark, which would certify her as the real, professional deal –not just to her fans, but more importantly to brands and possible business partners. A YouTuber’s primary income often comes from the work they create thanks to these partnerships, typically charging around $10,000 per 100,000 views for a sponsored video. All Westbrooke had to do for that potentially lucrative checkmark, according to the email, was enter her login information.
AdvertisementADVERTISEMENT
Westbrooke did just that, but nothing happened. The link, a bright “Get Verified” button, didn’t go anywhere. She was immediately suspicious, so she took to Google. That’s when she learned: Instagram doesn’t email people about account verification.
Almost immediately, her heart sunk, and she sprang into action. She changed her Instagram password, but didn’t consider that her Snapchat account had the same login. By the time she remembered, it was too late. A hacker—known as J.Prone— had already taken over. He had changed not just her password, but also her phone number, email, and anything else associated with the account that she could have used to get it back. J. Prone then started promoting himself on her Snapchat account by posing as Westbrooke, posting screenshots of his own Snapchat account and directing her large following of over 14,000 viewers to follow him. As Westbrooke, he promised fans follow-backs and streaks (the term for uninterrupted communication via Snapchat photos sent back and forth between two users).
Westbrooke did have access to an account that wasn’t compromised: her mom’s. This was the account she used (with permission) to get in contact with the hacker after about an hour of him wreaking havoc.
“I sent him a Snapchat [picture] of myself saying ‘Hey, how are you liking my account’ And he responded with ‘lol who r u,’” Westbrooke told me. “And I came back with ‘I'm Madi Westbrooke, what do you mean who am I? You know who i am, you hacked me.’”
AdvertisementADVERTISEMENT
She offered him a trade: she would shout him out in her videos, on Instagram, or anywhere else — she just wanted her account back. And she did shout him out, but J.Prone didn’t hold up his end of the deal. In the end, it was Snapchat support who fixed the situation, changing back the email associated with the account. But the damage was done. In the four days following the hack before she regained access, Westbrooke lost twelve thousand views’ worth of followers who had realized her account had been hacked and jumped ship. The hacker also disappeared — but not for long.
“I was not the only person he hacked,” Westbrooke said. “His main target are girls on YouTube who have a large following on their social media accounts...He did tell me he gets paid to do this, so he was advertising himself just to get more followers and views. That was his only purpose.”
Westbrooke is one of a handful of female YouTubers who have been targeted by J.Prone in the past year, all popular enough to have a valuable number of followers, but not enough that they’re already verified on Instagram. In addition to Westbrooke, YouTubers Madelynn de Rosa, Bree Lesch, and Ava Jules all spoke to me about their experiences with this now-notorious hacker. Each time, his M.O. was the same: a fake email offering verification followed by a hack, self-promotion, and holding the account hostage while demanding its owner give him shout-outs.
“I started getting weird comments on my photos saying things like, ‘Go away, hacker!’ I didn’t know what was going on, but sure enough, a few moments later I was locked out of my account,” de Rosa told me about the experience. “He started posting photos and videos threatening to leak my phone number (half of it was blurred out) and told people to go over to his page to view the full number.”
AdvertisementADVERTISEMENT
The first time I heard of J.Prone was last October, after I noticed odd activity on de Rosa’s account. Both de Rosa’s Instagram and YouTube reflected her aesthetically pleasing, vegan, vintage-inspired lifestyle, but on this particular day, blurry dark photos and indistinguishable short videos of the floor started appearing on her account, with J.Prone tagged in all the captions. I couldn’t make sense of any of it until I clicked on his name.
Turns out, J.Prone has built up a following of his own. While some influencers post outfit photos and shill meal kits, J.Prone used his page to harass and brag about the YouTubers and influencers he’s hacked, posting personal details, like de Rosa’s phone number, as well as photos of his victims.
It had long been a goal of mine to talk to a hacker like J.Prone. What’s the point? What does a hacker gain from a couple minutes of access when they’re sure to be immediately booted off the platform? Is there a financial component I wasn’t aware of?
Soon after I spotted what happened to De Rosa, I direct messaged J.Prone on Instagram to find out just that. I assumed he wouldn’t talk to a reporter, but I quickly learned he was eager for the attention. The first thing he wanted to know was whether or not I’d put our interview on Refinery29’s Snapchat, and I learned later that day that he had posted a screenshot of my message on his Instagram story (some of his followers reached out to warn me that I could be a potential target). He was very willing to answer my questions, but stuck to Instagram DM to answer them.
AdvertisementADVERTISEMENT
J.Prone wouldn’t say whether or not he specifically targeted women. Instead, he told me that he looked “around on YouTube and see YouTubers with a good amount of followers” but aren’t verified — a limbo in which many female creators find themselves. Only one woman made Forbes’ 2017 Top 10 Highest Earning YouTubers list , and the most popular channels are overwhelmingly male. At the same time,YouTube’s Chief Business Officer Robert Kyncl, said in an interview that YouTube would like “more and more female creators on the platform.” This uphill challenge for women on YouTube is what leaves them so vulnerable to hacks like this, which can in turn be serious professional and financial roadblocks. And the cycle goes on and on.
“It’s not gender-specific for gender’s sake, but there could be similarities there with female online behavior,” Eva Velasquez, CEO and President of the Identity Theft Resource Center told Refinery29, adding, “It’s a target-rich environment that he’s looking at. He’s basically like, ‘Oh, here’s this demographic, this segment of the population that has this need that I can tell them I can fill.’”
J.Prone says he’s hacked over 500 accounts (“Too many to count, ha”) and does it for money and followers. First, he says, he’ll offer to sell the account back to its original owner for around $200, as long as they give him shoutouts. If they won’t play along, there’s a more lucrative option. It’s not the victim’s identity that’s the most valuable, per se, but their followers. Once he’s taken over, he can resell the account to anyone looking for a ready-made audience, sometimes for over a thousand dollars. For instance, Reddit has a whole subreddit dedicated to selling accounts (from Instagram to Paypal to Spotify). Lifestyle YouTuber Bree Lesch says her hacked account was sold to someone who then turned it into a page to sell clothing, and changed the name. She never got it back, and ended up just making a new one under the username @BreeLesch.
AdvertisementADVERTISEMENT
Just as suddenly as he appeared, J.Prone is now gone – at least that particular moniker is. It’s hard to believe someone with over 500 hacks allegedly under this belt hasn’t been booted off a platform before; it's unclear if Instagram took any action against him (a spokesperson for the company told me they don't comment on individual accounts) or if he left of his own accord. As for hacking, Instagram told me it works “hard to provide the Instagram community with a safe and secure experience.” Typically, when they find out an account has been hacked, they close access to the account, and those affected are put through “a remediation process” to reset their password and take other necessary security steps, like two-factor authentication.
However it happened, J.Prone’s departure isn't the end of these types of setbacks for women online; just scroll through the countless“My Instagram Was Hacked!” videos on YouTube for evidence. It only takes one successful attempt for a hacker to completely derail years of hard work.
Security-wise, Instagram still treats its platform like a hobby, not a part of someone’s identity — and in the case of Westbrooke and others, their career. “If the default privacy settings were the same settings the CEOs of these companies had on their accounts, we might see some systemic change,” Velasquez told me. “If we had the type of multi-factored authentication for these accounts that we do for our financial accounts, we might see some change. It’s the convenience-versus-security conundrum.”
It's yet another roadblock for creators – especially female ones. And while it's easy to say that one day we’ll live in a world where less gender disparity exists and where women aren’t especially vulnerable to attacks, it’s clear we’re at the beginning of an uphill battle. Until then, it might be time to change your password.