A med spa owner texted us on a Sunday night, panicked. Her Instagram, 9,000 followers built over four years, was gone. Someone had changed the email and password, swapped the profile photo for a sunglasses avatar, and started messaging her followers a fake giveaway link. Worst of all, the DMs were full of patients asking about Botox pricing and sending photos of their concerns. A stranger was now sitting on all of it. Her question came in two parts: how do I get it back, and how bad is this?
Both are fair questions, and most owners never think about either one until the morning the password fails. So let us answer both honestly. First the emergency plan, step by step, because when it happens you want a checklist, not a lecture. Then the prevention plan, because this is almost entirely avoidable. And finally the bigger lesson, which is the uncomfortable one most practices would rather not hear.
What actually happens when they get in
A hijacked practice account is not just an inconvenience. In the first hours, the person who took it usually does some mix of the following, and knowing the pattern helps you move faster.
- They lock you out. The email and phone on the account get changed, often with the hacker's own two factor authentication switched on, so the normal reset path closes behind them.
- They mine the DMs. Your inbox holds patient names, symptoms, before photos, and appointment requests. That is sensitive information sitting in a consumer app, and now a stranger has it.
- They scam your followers. Fake giveaways, crypto, or a "we are verifying accounts" phishing link, sent from your trusted name to the exact people who trust you.
- They spend your ad money. If a payment method is linked through the business account, a takeover can mean fraudulent ads running on your card before you notice.
The reputation damage can outlast the account itself. Patients who get scammed by a message from "your" page do not always know it was not you. That is why speed matters so much, and why the real fix starts long before anything goes wrong.
The emergency plan: what to do in the first hour
If it is happening right now, work through this in order. Do not waste time posting "we have been hacked" from a personal account before you have tried to take the real one back.
- Try the login link first. On the Instagram login screen, tap "Forgot password" and request a login link or a six digit code to the email and phone still on file. If the hacker has not changed them yet, you may get straight back in.
- Use the hacked account flow. Go to instagram.com/hacked. Meta can send a code to a secondary email or walk you through a video selfie to confirm you are the real human behind the account. For a business page, the same recovery lives inside your Instagram and Meta business tools.
- Check your email for the reversal link. When a hacker changes your account email, Meta sends a message to your original email that includes a "revert this change" or "secure my account" link. That link is your fastest way back. Search your inbox for it before you do anything else.
- Once you are in, slam the doors. Change the password, log out of all other devices, turn on two factor authentication with an authenticator app, and remove any unknown email, phone, or connected app.
- Protect the patients. If the DMs held anything sensitive, treat it seriously. Post a short, honest note once you are back in, warning followers not to click any link the account sent while it was compromised.
The HIPAA angle most owners miss
Your social media inbox is not a safe place for clinical details, and a takeover makes that painfully clear. When a hacker reads DMs full of patient names, photos, and symptoms, that can be an unauthorized disclosure of protected health information. Keep clinical conversations out of Instagram and Facebook entirely, move patients to a secure intake method early, and if an account with patient messages is compromised, tell whoever handles your compliance. A hacked account is a security incident, not just a marketing headache.
How long recovery takes, honestly
Sometimes you are back in within the hour. Sometimes it drags for days or weeks, especially when the hacker has changed every piece of contact information and enabled their own two factor. In its research on small businesses, the Identity Theft Resource Center found that most compromised business accounts are eventually recovered, but some owners were locked out for as long as 30 days. A month without your main booking channel, during which a stranger is messaging your audience, is a real cost. The practices that recover fastest are the ones that kept access to the original email and set up proper business ownership before anything went wrong.
The scale of this is worth sitting with. The Federal Trade Commission reported that Americans lost more than 12.5 billion dollars to fraud in 2024, and social media is one of the most common places those scams begin. Your practice page is a small but attractive piece of that landscape. Treating it like the business asset it is, is just common sense.
The prevention plan: make it a non event
Here is the good news. Almost every takeover we see traces back to two or three missing habits. Put these in place once and the odds drop dramatically.
- Two factor authentication on everything, app based. Use an authenticator app rather than text message codes, which can be intercepted. This one change stops the majority of casual takeovers.
- A unique password per platform, in a password manager. Reusing one password across Instagram, Facebook, and email means one leak unlocks all three. The ITRC found only about a third of people never reuse passwords, which is exactly why reuse is such a common way in.
- Own the account through Meta Business Suite. The page should belong to a business asset, not one person's personal profile. Give each staff member their own access, and remove them the day they leave. Shared logins are a slow leak waiting to happen.
- Never log in through a link. The classic trap is a DM about a "brand collaboration" or a message warning that your account will be deleted, with a link to "verify." That link is a fake login page. Only ever log in from the real app or instagram.com.
If managing all of this on top of running a practice sounds like one more thing you do not have time for, that is exactly the point of handing social media management to a team that treats account security as part of the job, not an afterthought.
The bigger lesson: stop building on rented land
Here is the part most practices do not want to hear. You do not own your Instagram followers. You do not own your Facebook page. Meta does. They can disable, restrict, or lose your account, and a hacker can take it, and in every one of those cases the audience you spent years building can vanish overnight. We are not saying abandon social media. We are saying do not let it be the only place your patients can reach you.
The assets you actually own are the ones no platform can switch off: your website, your domain, and your email list. An email list is the single best insurance policy against a lost account, because it is an audience nobody can take from you. If you have never built one, start with our guide on how to build an email list for your medical practice, and read why owning your own website matters more than most owners realize. Even your Facebook page, useful as it is, should never be the foundation, as we explained in whether a practice really needs a Facebook page.
Social is a wonderful front door. It should never be the whole house. The practices that sleep well are the ones who use Instagram to get found, then move people to channels they control, so that a bad Sunday night is an annoyance and not a disaster. That is also the difference between chasing followers and turning them into patients, which we covered in turning Instagram followers into booked patients.
How we handle this at EtherealMinds
When we run social media for a practice, security is built in, not bolted on. Accounts live inside proper business ownership, two factor is on, staff get their own access, and nobody is logging in through a sketchy brand deal link. Just as important, we never let social be your only lifeline. We pair it with a fast website that converts, local and AI search so patients find you on Google and in chat answers, and a growing email list you actually own. Inquiries that come through any channel, including the after hours ones, get answered fast by your team or by our AI receptionist, so a booking is never lost in a DM a stranger might one day read. The goal is simple: build on ground you own, and treat the rented land for exactly what it is.
Lock down your accounts before you need to
Book a free strategy call and we will do a quick, no pressure review of how your practice's social accounts, website, and patient list are set up, and show you where the single points of failure are. You walk away with a clear plan to protect what you have built, whether or not you ever work with us.
Book a free strategy call →