ST. LOUIS — Cybersecurity breaches have increased this year. Even strong passwords and two-factor authentication aren't enough anymore.
Syndi Sills isn’t your average social media user. As an IT director at a law firm, she understands online security.
“I've become a nonstop security cop. That's what I call myself because it just never stops," she said.
She’s also run two charities from her home in Florissant for six years. Last December, her world changed when scammers hijacked her personal account on Facebook, owned by parent company Meta, leaving her locked out of her charity pages. She had a 23-character password and two-factor authentication.
"It's just so sad," she said. “As big as a company that Facebook is, you would think that they would care about their people and that they would want to keep everybody safe," said Sills.
Her story is shockingly common. A Reddit community called ‘Facebook Disabled Me’ has 19,000 members. They're people from around the globe facing the same nightmare. We discovered some victims end up paying around $14 a month for Meta Verified, a service designed to protect accounts. But even after subscribing, many are still locked out.
“That just kills me because they're purchasing something to get something back that they never should have lost to begin with," said Sills.
Another online group with about 560 members has been pushing for class-action lawsuits.
The pattern is disturbingly familiar: scammers take over accounts, rack up charges, and victims are left powerless.
Thankfully, Sills' American Express credit card caught the $400 in fraudulent charges. But she said she lost priceless memories and the ability to run her businesses. We asked Sills how she feels about Meta's response to the situation.
“They haven't, they haven't responded to it and that's what's so frustrating," said Sills.
The problem of business owners losing access to their accounts caught the attention of 41 attorneys general nationwide, including Illinois AG Kwame Raoul. They’re demanding Meta take responsibility and implement stronger security measures to prevent account takeovers.
Raoul’s office said they urge any consumer experiencing this issue to file a complaint with their office.
“We have seen an uptick in phishing scams, social engineering scams," said cybersecurity expert Michael Scheumack, chief innovation and marketing officer with Identity IQ, an identity theft protection company. He’s also an advisory board member with the Identity Theft Resource Center, a nonprofit supporting victims like Sills. He said identity theft is skyrocketing.
Research from the Identity Theft Resource Center shows there’ve been more than 1.3 billion data breach victims in the U.S. so far this year, a 401% increase from the same time last year, referring to January to September data for 2023 and 2024. Scheumack said the spike is driven by more people linking their financial accounts. He warns that once criminals gain access, it’s often too late.
"If they change an email or the phone number associated with that account, it's more than likely you won't gain access back to your account. So you'll lose all of your content, you'll lose access to it," he said.
He tells the I-Team usernames and passwords are no longer strong enough. He urges the use of biometrics like facial recognition and fingerprints to log in.
“If this happened to you, an IT director, what hope is there for the rest of us?” asked Vasan.
“I don't know, honestly," said Sills.
Missouri Attorney General Andrew Bailey’s office told us the office is currently prosecuting a lawsuit against Meta for consumer protection violations, specifically focusing on the impact on young people. We asked if the office would join attorneys general nationwide to address the problem of user account takeovers and lockouts on Facebook and Instagram. They did not provide an answer.
Despite our multiple inquiries, Meta has not responded, reflecting business owners’ frustrations. We’ll keep pushing for answers.
Got a tip? Contact Senior Investigative Reporter Paula Vasan at paula@ksdk.com.