Facebook, Instagram, TikTok and Twitter crack down on 'OGUsers' theft ring

After a coordinated investigation, the social media platforms suspend hundreds of accounts that were stealing and selling access to coveted usernames.

Ry Crist Senior Editor / Reviews - Labs
Originally hailing from Troy, Ohio, Ry Crist is a writer, a text-based adventure connoisseur, a lover of terrible movies and an enthusiastic yet mediocre cook. A CNET editor since 2013, Ry's beats include smart home tech, lighting, appliances, broadband and home networking.
Expertise Smart home technology and wireless connectivity Credentials
  • 10 years product testing experience with the CNET Home team
Ry Crist
2 min read
Angela Lang/CNET

Facebook, Instagram, TikTok and Twitter removed hundreds of accounts Thursday after an investigation into "OGUsers," a forum for trafficking stolen usernames and phone numbers.

The crackdown, as reported by Krebs on Security, represents the results of a coordinated effort by the platforms to scrutinize the most active members of the OGUsers theft ring. Tactics to wrest control of coveted short usernames, which can reportedly fetch a resale value of thousands of dollars, include hacking, coercion and extortion.

Facebook, which owns Instagram, told CNET that the investigation resulted in the removal of hundreds of accounts.

"Today, we're removing hundreds of accounts connected to members of the OGUsers forum," a Facebook spokesperson said. "They harass, extort and cause harm to the Instagram community, and we will continue to do all we can to make it difficult for them to profit from Instagram usernames."

Seemingly to that end, Vice reports that members of the OGUsers forum have received cease-and-desist letters from Facebook calling on them to stop using Facebook's and Instagram's services "for any reason whatsoever," to shut down all websites offering services related to Facebook or Instagram, and to preserve all information related to the matter moving forward.

"Facebook will treat any further activity by You on its websites, mobile applications, Platforms, services, or networks as intentional and unauthorized access to its protected computer networks," the letter reportedly also says. 

A Facebook representative acknowledged to CNET that a set of cease-and-desist letters was sent Thursday, but the company can't confirm whether the screenshots posted to Vice are accurate without viewing the entire document. However, the screenshots appear authentic as an excerpt, the spokesperson said.

As for Twitter, a company representative told CNET that it suspended "a number of accounts" included in the OGUsers network in accordance with its platform manipulation and spam policy.

"This investigation was done in tandem with Facebook," the spokesperson said.

TikTok didn't immediately respond to a request for comment, though the company confirmed to Krebs on Security that it took action to target accounts tied to OGUsers and reclaim an unspecified number of accounts.