Are you running Facebook\/Instagram ad campaigns for your dental practice, or perhaps more importantly, is an agency running these on your behalf? If so, then this blog has some important security information for you.<\/p>\n
A few weeks ago, one of our long-term clients had their Facebook (Meta) ads manager account hacked. The hackers waited until the early hours of the morning and then increased the daily spend limit of the account to \u00a315,000. They then very quickly published scam adverts and churned these out to tens of thousands of unsuspecting users \u2013 all paid for by the client\u2019s credit card! It was 8am the following morning before the hack was spotted but by this stage, thousands of pounds of the client\u2019s money had been spent.<\/p>\n
This is a \u201cchurn and burn\u201d attack i.e. the hackers know that it will likely be spotted quickly but by accessing overnight, they can still push out lots of spam ads and spend a lot of money before it gets closed down \u2013 very dangerous. Their ads purported to sell personal medical devices which very likely didn\u2019t get delivered to the folks who clicked the ads and paid for them. This was a clever scam, but at the same time appalling. Unfortunately the hackers were able to access the top-level client\u2019s account where there are no controls on the daily click budget \u2013 so they could simply change it to whatever they wanted.<\/p>\n
Our client couldn\u2019t understand how the hackers got in as they use two-factor-authentication (2FA) \u2013 and we do too. So in theory this should not have been possible. We are linked to the client\u2019s account to facilitate the administration of the ads, however we are extremely cautious and we knew that the hack hadn\u2019t come via ourselves. This meant that the hack either came via the client (they were adamant that it hadn\u2019t) or something else. It didn\u2019t take us long to see what had gone wrong.<\/p>\n
<\/p>\n
Although the hackers had tried very hard to cover their tracks within the account, we could see from the change logs that they had accessed via a link to an old ads agency that the client had failed to remove. We couldn\u2019t see that link as we only had administrative access for ads \u2013 not top-level account ownership. As part of our general advice, we always advise that old account connections are removed but unfortunately the client hadn\u2019t followed this.<\/p>\n
We quickly helped the client to shut down the hack and remove the connection to the old agency from where the hack originated. We also contacted the agency and credit to them they were totally transparent and advised that they\u2019d had a lot of their clients affected in the same way. What they wouldn\u2019t say is how they got hacked but it seems likely that it was a password leak coupled with a failure to use 2FA. Whatever it was, the outcome was devastating.<\/p>\n
We also offered the client guidance about how to claim the lost money back from Facebook and they may also have approached the other ad agency for compensation.<\/p>\n
The client is understandably cautious but following a detailed explanation of what happened and removal of the rogue account, we are now able to move forward with best-practice security controls in place. This means full use of two-factor-authentication and only approved management accounts allowed to have linked access. Of course the usual \u201cstrong password\u201d requirement also applies.<\/p>\n