When a corporate social media account is hijacked, the attacker speaks with the organisation's voice to its whole audience within minutes, usually to push a cryptocurrency scam, and the platform's recovery process is the only way back in. Brand accounts on LinkedIn, X, Instagram, Facebook and YouTube are rarely managed like other privileged systems: they are often tied to one person's phone number or personal email, shared by agencies, and outside single sign-on. This playbook template gives [Organisation] a response for a hijacked brand account: who does what, how to triage, how to contain while the account is out of your hands, which platform routes to use, and how to talk to customers who may already have been scammed. It is for social media managers, communications teams, security operations and the agencies that post on [Organisation]'s behalf. Platforms are listed alphabetically. Replace every [placeholder] before use; for workforce and service accounts inside your identity provider, use the Account Takeover Response Playbook instead.
How to use this template
- Prepare the account register first. The playbook fails without a list of every official account, its owner, its login email, its recovery phone, who holds admin roles and which third-party tools are connected. Build it now, not during the incident.
- Treat it as a joint security and communications playbook. Recovery is a security task; the public message is a communications task. Both start at the same moment.
- Keep platform details current. Recovery forms and admin models change. Review each platform's help pages for the routes in section 6 every six months and record the date checked.
- Drill it yearly with a tabletop: the main brand account posts a fake giveaway at 19:00 on a Friday.
1. Scope and triggers
1.1 This playbook applies to every official [Organisation] account, page, channel and business portfolio on public social platforms, including executive accounts that the organisation manages, and accounts run by agencies on its behalf.
1.2 Common entry routes:
| Entry route | ATT&CK reference | What it means for response |
|---|---|---|
| Phishing of the social media manager, often a fake copyright, policy violation or brand partnership message | T1566 Phishing | The person's email and other accounts may also be compromised |
| SIM swap of the phone number used for login or recovery | T1586.001 Compromise Accounts: Social Media Accounts | SMS codes and SMS recovery are now the attacker's; secure the mobile account first |
| Session cookie stolen by an infostealer on a marketer's or agency laptop | T1539 Steal Web Session Cookie | Password reset alone will not end access; sign out all sessions |
| Compromised scheduling or analytics tool with posting rights | T1528 Steal Application Access Token | Revoke the connected app, not just the user password |
| Agency or freelancer account with admin role compromised | T1199 Trusted Relationship | Remove the third party's role until its own incident is closed |
1.3 Triggers: posts, messages, livestreams or profile changes nobody in [Organisation] made; a cryptocurrency giveaway, airdrop or investment link from an official account; login or security email or SMS alerts for a change nobody requested; the account name, handle or picture changed; staff locked out; customers or journalists asking whether a post is genuine.
1.4 A real case to brief executives with: on 9 January 2024 the US Securities and Exchange Commission's X account posted a false announcement that spot bitcoin ETFs had been approved. The SEC said an apparent SIM swap gave the attacker control of the phone number tied to the account, and that multi-factor authentication had been disabled by X support at staff request in July 2023 and was not re-enabled until after the incident.
2. Roles and contacts
| Role | Named lead | Responsibilities |
|---|---|---|
| Incident lead (security) | [Name, phone] | Declares the incident, owns the timeline, decision log and recovery |
| Social media manager | [Name, phone] | Knows the account register, attempts recovery, documents attacker posts |
| Communications lead | [Name, phone] | Approves holding statements on other channels and the website |
| Agency contact | [Agency, name, phone] | Confirms whether their staff or tools are involved; secures their access |
| Legal and privacy | [Name] | Assesses direct messages or customer data exposed; regulatory and fraud reporting |
| Customer service lead | [Name] | Briefs contact centre staff with a script for scam victims |
| Platform partner manager (if any) | [Platform, contact route] | Escalates recovery through any business support channel [Organisation] has |
2.1 Record for each platform the support route [Organisation] can actually use: public help forms, business or advertiser support, or a named partner manager.
3. Detection and triage
3.1 Capture evidence immediately. Screenshot every unauthorised post, message, bio and profile change with the visible URL and time. Save links to the posts. The attacker may delete them, and platforms need them for recovery and appeals.
3.2 Establish access status. Can any admin still sign in? Has the login email or phone changed? Check the mailbox that receives the platform's security alerts for "email changed" or "new login" messages; these often contain a link to reverse the change.
3.3 Scope the blast radius:
- Which accounts share the same email, phone, password manager entry or agency login?
- Which connected tools (schedulers, social inboxes, analytics, ad accounts) have posting or messaging rights?
- Is an advertising account with a payment method linked, and has spend appeared?
- Were direct messages to customers sent or read? Those may hold personal data.
- Is the compromised person's work mailbox or laptop also compromised? If so, also open the workforce account takeover playbook.
3.4 Severity: Critical: main brand account with a large following posting scam or market-sensitive content, or ad spend running. High: secondary or regional account posting, or an account locked with no recovery path. Medium: login alert or suspicious change with no public posts yet.
3.5 Decision (incident lead): declare the incident and start sections 4 and 7 in parallel, or close with recorded evidence that the activity was authorised (for example an agency post nobody was told about).
4. Containment
4.1 If any admin still has access, act in this order: change the password to a new unique one from the password manager; sign out all other sessions; remove any login email, phone or authenticator the attacker added; remove unknown admins or roles; revoke connected apps nobody recognises; turn on the strongest second factor the platform offers. X's guidance for a compromised account, for example, is to reset the password, make sure the linked email is secure and only you can access it, and revoke unrecognised third-party apps under Apps in settings.
4.2 Delete or hide attacker content once screenshots are kept. YouTube advises deleting uploads you did not make immediately and reverting unwanted channel changes, because content posted by an attacker can lead to Community Guidelines or copyright strikes against the channel.
4.3 If nobody has access, containment happens around the account:
- Secure the mobile number (call the carrier, add a port-out PIN or SIM lock) and the recovery mailbox before starting platform recovery. See the SIM Swap Fraud Guide.
- Pause or remove payment methods on linked ad accounts through the billing owner.
- Revoke the account's access from the scheduling tool's side if the tool's admin console allows it.
- Report the hijacked account to the platform through its official hacked account route, and ask staff and partners to report the scam posts too.
4.4 Isolate the source device. If an infostealer or session theft is suspected, isolate the social media manager's or agency laptop and treat every browser-saved credential on it as exposed. See the Session Hijacking and Cookie Theft Guide.
5. Eradication
5.1 After access is restored, remove every attacker change: profile name, handle, picture, bio and links; pinned posts; scheduled posts; admin and role assignments; connected apps; login emails, phone numbers and authenticators; ad campaigns and audiences; auto-replies.
5.2 Reset the passwords of the compromised person's email and of every account that shared a password, and sign out of all sessions there too. The NCSC's recovery guidance also says to check email filters and forwarding rules, because attackers use forwarding to receive password reset messages for other accounts.
5.3 Rotate the credentials of any connected tool and re-grant only the tools that are still needed, with the narrowest permissions. See the Social platform app tokens guide.
6. Recovery
6.1 Use only official recovery routes. Never pay or engage a "recovery service" offering to get the account back: these are a common follow-on scam.
| Platform | Recovery route to record in your register | Preparation that speeds recovery |
|---|---|---|
| Facebook and Instagram (Meta) | The platform's hacked account flow from the login screen, and the business portfolio's admin controls for Pages and Instagram accounts it owns | Own Pages and Instagram accounts through a business portfolio with at least two admins on separate personal accounts, both with two-factor authentication |
| Personal account recovery for the admin, then Page admin management by a remaining super admin; LinkedIn's help centre for Page access disputes | At least two super admins who are current employees on a company email, reviewed quarterly | |
| X | Password reset, then a support request from the account's email address with the username and the date of last access if sign-in still fails | Login verification enabled with an authenticator app or security key, not SMS; a company-controlled email |
| YouTube | Recover the linked Google Account first, revert channel changes, then use the hacked channel assistant; appeal any termination only after the Google Account is fully recovered; Creator Support covers incidents within the past nine months | Use Channel Permissions or a Brand Account so people sign in with their own Google Accounts instead of sharing one password |
6.2 Validate before reopening. Confirm that only expected admins, emails, phones and apps remain, that strong second factors are on, and that no scheduled attacker posts are pending. Monitor the account closely for [14] days.
6.3 Decision (incident lead and communications lead): abandon or wait. If recovery is refused or stalls beyond [72 hours] for a critical account, announce on other official channels that the account is not under [Organisation]'s control, and consider a new verified account. The NCSC's recovery guidance gives the same fallback: create a new account and tell contacts the old one is abandoned.
7. Communication and notification
| Audience | Owner | Message and timing |
|---|---|---|
| Followers and customers | Communications lead | Within [1 hour] of declaration, on the website and other official accounts: the account is compromised, do not click links or send money, [Organisation] will never ask for cryptocurrency |
| Customer service and staff | Customer service lead | Script for people who sent money: report to their bank and to the national fraud reporting service; no promises of refunds without legal approval |
| Executives and board | Incident lead | At declaration for Critical, with the holding statement |
| Data protection regulator | Privacy lead | If direct messages or other personal data were accessed and the breach is notifiable: under UK and EU GDPR Article 33, without undue delay and where feasible within 72 hours of becoming aware |
| Market regulator or exchange | Legal | If a false market-sensitive statement was posted, follow [Organisation]'s disclosure procedure |
| Police and fraud reporting | Legal | Report the fraud with screenshots and wallet addresses from scam posts |
7.1 After recovery, post a short confirmation that the account is back under control, what happened at a high level, and what followers should do if they interacted with the scam. The NCSC's recovery advice includes telling contacts and followers you were hacked so they treat recent messages from the account with suspicion. For scam content patterns see the Crypto Scam and Drainer Guide.
8. Post-incident review
8.1 Within [10] working days record: first unauthorised action, detection time and source, time to holding statement, time to recovery, number of scam posts and their reach, and any customer losses reported.
8.2 Root cause questions: Was the account tied to one person's phone or personal email? Was two-factor authentication on, and was it SMS? Did an agency or tool hold standing admin rights? Was the account in the register at all?
8.3 Track: percentage of official accounts in the register with two or more admins, percentage with app-based or security key second factors, percentage of connected apps reviewed in the last quarter, and time to holding statement in drills.
Implementation guidance
- Register every account with owner, login email (a company-controlled group mailbox, not a person), recovery phone (a company-owned number with a carrier PIN), admins and connected apps. Include regional, product and executive accounts. A register also lets customer service confirm which accounts are genuine.
- Remove shared passwords. Use each platform's role model (business portfolios, Page admin roles, YouTube Channel Permissions) so each person and agency signs in as themselves. Where a shared login is unavoidable, keep it in a password manager with access logging.
- Use the strongest second factor available, preferring security keys or passkeys, then authenticator apps, over SMS. The NCSC recommends two-step verification wherever it is available. See the Phishing-Resistant MFA Guide.
- Review admins and apps quarterly, and on every leaver and agency change.
- Protect the people. Give social media managers a dedicated, managed device and training on copyright and policy violation lures. See the Disinformation and Brand Impersonation Guide.
- Size it. A small organisation with two or three accounts needs the register, two admins per account, app-based two-factor and a pre-written holding statement. A large organisation should run accounts through a business management layer, an approved social media management tool, monitoring for brand mentions and lookalike accounts, and a named contact at each major platform.
| Playbook element | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Account register and admin reviews | PR.AA-05 | AC-2 | A.5.9, A.5.18 |
| Strong second factor on brand accounts | PR.AA-03 | IA-2(1) | A.8.5 |
| Triage and containment | RS.MA-02, RS.MA-01 | IR-4 | A.5.25, A.5.26 |
| Public and customer communication | RS.CO-02, RC.CO-04 | IR-6 | A.5.26 |
| Agencies and connected tools | GV.SC-07 | SA-9 | A.5.19, A.5.22 |
| Review | RS.AN-03 | IR-4 | A.5.27 |
For individuals whose personal accounts are hijacked, point them to the Hacked Social Media or Email Account Recovery Guide.
References: NCSC: Recovering a hacked account · NCSC: Social media, how to use it safely · X Help Center: Help with my compromised account · YouTube Help: Get help with a hacked channel · NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management · MITRE ATT&CK: T1586.001 Compromise Accounts: Social Media Accounts · CNBC: New details emerge about SEC's X account hack, including SIM swap
This template is provided for guidance and must be adapted to your organisation. Related NHI Mgmt Group resources: Account Takeover Response Playbook · Account Takeover Prevention Guide · Brand Impersonation and Lookalike Domain Takedown Playbook · Social Media Privacy Settings Guide · Incident Response Plan Template