For Restaurant Owners, Instagram Hacks Create Major Headaches

One day in March, the pastry chef Bronwen Wyatt was posting a picture of one of her signature squiggle-decorated cakes on Instagram when she was suddenly logged out of her account. When she tried to log back in, an error message appeared, so she clicked a button to request support. Soon enough, she got an email back from Instagram that said her account had been deactivated for violating their terms and conditions, which didn’t make sense. Wyatt only uses @bayousaintcake, the handle for her tiny New Orleans bakery for which she’s amassed 19,000 followers, to showcase her work, announce updates to her schedule, and surface her booking link (in her bio). For these reasons, Instagram is intrinsic to her business. She had plans to release a new menu a few days later, which is also when she opens up her orders for the month. “I’m probably not going to get any, because I can’t announce it to the people that I need to reach,” she said at the time.

Wyatt immediately filled out appeals forms through Instagram’s help center. Then she reached out to Emily Schultz, a social media manager at the restaurant tech company BentoBox (and a follower of @bayousaintcake). Schultz recommended that she create a backup account as soon as possible, which she could promote from her personal account, explaining what had happened. The carousel post Wyatt crafted as a plea for help, posted to a backup account she called @bayousaintcake2_thecakening_, generated leads of direct contacts to employees at Meta — the company that owns Instagram, Facebook, and WhatsApp — who were able to submit internal support tickets that would attract more immediate attention. As she waited for those folks to accelerate the recovery process, she worried: Pretty much all of her cake sales come from customers who see her new menu drops on Instagram.

Wyatt’s story is unfortunately familiar to many businesses using Instagram to market and sell food, a group that grew during the pandemic. As restaurants struggled through lockdown regulations and as they continue to navigate staffing shortages, they’ve often turned to Instagram as the site for real-time updates; diners have become more reliant than ever on checking their favorite restaurants’ Instagram pages. It’s so valuable that some operators have considered paying ransom to hackers who gain control over their accounts.

A few months ago, the Instagram account for Dame, a popular seafood restaurant in New York City owned by Patricia Howard and Ed Szymanski (2021 Eater New Guard), was hacked. Howard found out when she woke up one morning, saw a WhatsApp message from the hacker requesting a sum of money, and then couldn’t log into Instagram. The hacker had changed the phone number and email address associated with the account, and turned facial recognition off as well. At the time, Dame’s account did not have two-factor authentication enabled, which creates another layer of security after a password is compromised. Howard spent the morning going through Instagram’s recommended channels for recovery and watching YouTube videos on how to get your account back until she realized she had a contact who worked at Meta — a woman whose kids she used to tutor — who might be able to help. Luckily, her former employer was able to expedite the process internally at Meta, and within 48 hours, Howard was back in control of @dame_nyc. Immediately, she turned two-factor authentication on.

“It brought up the conversation of how much our Instagram is worth to us,” Howard says. “We weren’t going to pay [the hacker], but we definitely talked about how integral our Instagram account is to our business and how I’ve spent a long time developing our followers and our community. It made me really scared and sad to think about losing that.”

A similar scenario unfolded for Frank Castronovo and Frank Falcinelli, the owners of Frankies Spuntino in Brooklyn, last December. The duo were locked out of @frankiesspuntino, which has more than 32,000 followers, for over two weeks, and the person who had control over the account was requesting a dollar per follower in order to return it to them. It was only thanks to a friend who worked at Meta that they were able to get it back. But as Falcinelli points out, the lack of clear support from Instagram to business accounts in compromised scenarios means that only those with a direct contact to someone inside the company are able to swiftly regain control of their handles. “The average person isn’t able to get their account back because they’re just told to call the 800 number that goes nowhere,” he says.

Castronovo and Falcinelli were also lucky in that they don’t rely on their Instagram as heavily as newer businesses might, since they’ve been established as a neighborhood restaurant for over a decade. “It didn’t really affect our business because people would just show up,” Castronovo says. “It just made it so we didn’t have the ability to make any announcements, and it was right during the pandemic, so everybody was changing their hours and their operation procedures a lot.”

Howard, on the other hand, says she communicates with guests on Instagram “all day long” and regularly posts last-minute reservation cancellations to Instagram stories for @dame_nyc’s almost 24,000 followers, which get booked within minutes. While she admits that getting hacked was a sobering experience, she says it didn’t make her want to change how she uses the platform, only that she “wishes there was a better support system for businesses using it.”

Brandon Gray, the Los Angeles-based pizzaiolo behind the takeout-only pizza operation Brandoni Pepperoni, was not as fortunate when he was hacked only days before the Super Bowl. Like Wyatt, his access to Instagram is more closely tied to his bottom line, since he doesn’t have a brick-and-mortar to generate foot traffic. And because he specializes in pizzas topped with farmers market produce in addition to Caesar salads and Buffalo wings, the Super Bowl was guaranteed to be the best sales day for his business, followed by Valentine’s the day after. Yet he had no way to promote specials, or let people know that his food would be available to help them celebrate. It was crushing, and after that, “the business tanked for a month,” he says. That’s how long he was locked out. Furthermore, owning and operating his business entirely on his own meant the attack felt personal. “To not have control over something that you own or you dictate, it was so violating,” he says.

Gray proceeded down the “rabbit holes” Instagram has you go through to get your account back, but says “it’s almost like there’s no person to talk to.” Eventually, he decided to make a backup account (which he called @la_brandoni_pepperoni_2) and promote it from his personal account, but he was unable to build a following of more than a couple of hundred people compared to the 5,000-plus he had on his hacked account. He says out of over 2,000 followers on his personal account, fewer than 100 people refollowed the new page.

Brandoni Pepperoni takes payment through Venmo and Zelle, which means Gray doesn’t have a list of email addresses that a credit card platform like Square generates for businesses. He did, however, have phone numbers, since he coordinates orders over text using a Google Voice number. He created a text message explaining what had happened to send to his customers, but he could only send 50 messages a day, otherwise his number would be marked as spam. “As only one employee, I just didn’t have the bandwidth to do this every day,” he says. “I started going through the motions of like, ‘Man, is this over for me?’” After the one-month mark, Gray was considering shutting down the business altogether when his friend’s account got hacked, too. She ended up having a friend who worked at Meta who was able to help both of them regain control of their accounts.

With the help of her own inside contact at Meta, Wyatt was able to get back into her account after 10 days. Her business took a hit in the meantime. When she posted her menu changes, she generated less than half of her usual sales. Moreover, the experience made her question her relationship with the platform, both as a business and on a personal level. “I felt dumb in retrospect for putting all of my eggs in one basket,” she says. Wyatt is now considering creating a mailing list to send email blasts, but her ordering system isn’t set up for that, and it’s a lot of extra labor on top of the 27 to 34 cakes she makes a week. She’s also “reluctantly” considering getting onto another social media platform, like TikTok or Twitter.

The depression Wyatt suffered over the course of those 10 days has influenced her perspective the most. “I realized that there was this dopamine thing that I was no longer getting. It wasn’t even just the fact that I couldn’t communicate about my business, I had literally lost something that I got a little rush from every single day. I was embarrassed at how much it affected me,” she says. “I realize now, too, that [being on Instagram] is truly just part of the job. There’s no smokescreen anymore, [the idea that] it’s something fun that I’m doing.”

Wyatt hasn’t deleted her backup account because she knows that it’s possible this could happen again. After all, @bayousaintcake wasn’t hacked and did have two-factor authentication enabled. She eventually received a terse email from Meta that said her account was disabled by mistake and apologized for any inconvenience, but she still doesn’t know why it happened in the first place.

Gray feels that he’s still recovering from his forced month-long Instagram hiatus. He says his posts aren’t getting as much engagement as before, and hypothesizes it’s because he’s fallen out of the algorithm’s favor, or isn’t great at making Reels — another issue that the New York Times reported is affecting food businesses on Instagram.

Howard says that other restaurants whose accounts have been hacked have been reaching out to her for help. She doesn’t feel comfortable giving out her own contact at Meta, as she doesn’t want to inundate her with requests, so she advises her peers to post on their personal accounts asking if anyone works at Meta, or knows someone who does. “There’s so many people that work for Facebook or Instagram that there’s usually someone in your network who passes it on to a friend who passes it on to another friend,” she says.

That this is the standard that Meta has seemingly put in place instead of transparent processes and responsive support for business owners hoping to swiftly regain control of their accounts is both maddening and unjust. While it’s true that Meta is a large company with many employees, not every food business is privileged to only be a few connections away from an inside contact. As Wyatt puts it, “If I was an activist, or a smaller business, or a person of color-owned business, I don’t think it would be this easy,” she says. “I’m grateful that so many people had connections that they were willing to give me, but I don’t think that’s true for everyone by any means.”

Emily Wilson is a Los Angeles-based food writer from New York. She has contributed to Bon Appétit, TASTE, Resy, the Los Angeles Times, Punch, Vegetarian Times, Atlas Obscura, and more. Isabela Humphrey is an illustrator and through her use of bold, unique figures and bright visual elements, she celebrates the vibrant spirit and strength of women.