Sarah Albert — SarahPaintsRappers, Washington DC (2022) Sarah was furloughed at the start of COVID and started painting portraits of rap artists from home. In less than two years, SarahPaintsRappers grew into a sustainable business, mainly thanks to social media — she launched accounts on Instagram and TikTok where influencers shared her content and she amassed thousands of followers. phishingforanswers Her entire business infrastructure lived on those accounts. No storefront, no separate customer database, no independent website driving sales. Instagram was the business. The Attack In May 2022, she received a message via Instagram from another alleged artist claiming to be participating in an art competition and asking for her vote. The message came from a seemingly legitimate account, and as an artist she frequently helped other artists promote their work. After she replied, hackers sent a code to her personal mobile phone, and after she verified it online, they took complete control of her business and personal Instagram accounts. phishingforanswers Within minutes, the fraudsters changed the emails and phone numbers linked to the accounts, added backup recovery codes and two-factor authentication — making it impossible for Sarah to use Instagram’s own recovery process, which requires access to contact information the attackers now controlled. They also unlinked her Facebook profile and associated new Facebook profiles with the stolen accounts. phishingforanswers The Recovery — Which Was Worse Than the Attack Over the following weeks, Sarah emailed every customer support, security, and anti-phishing service listed on Instagram’s website, including personal photographs, contact information, and screenshots as evidence. When she received no response, she messaged Meta employees on LinkedIn and leveraged personal connections to send internal emails at the company. phishingforanswers Meanwhile the hackers were using her account to attack her followers — and Instagram took no action even when other users reported the fraudulent messages. She attempted video verification — uploading videos of herself to confirm she was the authentic owner — which recovered her personal account but not her business account. At this point she had lost at least two weeks of income and had taken a position at a restaurant to support herself. phishingforanswers She eventually recovered her business account only because a follower — who had herself been hacked as a result of Sarah’s compromised account — had been featured in one of Sarah’s posts and could help verify her identity. The two women met and created numerous video verifications with various lighting options and hairstyles until achieving success. phishingforanswers The Aftermath Beyond the temporary loss of 8,000 followers and a notable decrease in sales, Sarah acknowledged there is now a lasting lack of trust in her Instagram account. In her efforts to publicly share details about the incident, she noticed additional scams targeting users whose accounts had been compromised — after posting about her experience on TikTok, suspicious accounts appeared in her comments claiming they could help recover accounts. phishingforanswers Sarah didn’t get hacked because she was careless or ignorant. She got hacked because she did something human — she helped another artist. The attack exploited her generosity and professional instincts, not stupidity. That makes her immediately relatable to any micro business owner. Her entire business was built on a platform she didn’t own, with no backup, no secondary channel, no customer list she controlled independently. When the platform was taken from her, there was nothing underneath it. That is the DR/BCP failure in its purest form — not dramatic, not technical, just the quiet absence of a safety net she never thought she needed. And the recovery cost her more than the attack itself.