The official Instagram account for the Obama White House, dormant since 2017, was hacked on Sunday and filled with unauthorized images, including an AI-generated picture claiming the White House was now under Shiite control, the Daily Mail reported.
The unidentified hacker took over the @obamawhitehouse account and posted memes to the page and its Instagram Stories. TMZ first reported the breach, noting the AI-generated image among the content added to the account.
A Meta representative said the account has been secured and all unauthorized content removed. Meta is Instagram's parent company. No statement from any Obama-affiliated office has surfaced, and the method the hacker used to access the account remains unknown.
The @obamawhitehouse account had not been updated since President Donald Trump took office for his first term in 2017. For eight years it sat untouched, a digital artifact from a prior administration, apparently still live and apparently still vulnerable.
This is not the first time. The same account was compromised in a sweeping July 2020 attack that also hit the accounts of Joe Biden, Bill Gates, and Elon Musk. In that incident, the hacked accounts for Gates and Musk promised Bitcoin payments to followers, a textbook cryptocurrency fraud.
The FBI told NBC News at the time that it was aware of what it called a "security incident involving several Twitter accounts, belonging to high-profile individuals" used to "perpetuate cryptocurrency fraud." The bureau warned the public directly:
"We advise the public not to fall victim to this scam by sending cryptocurrency or money in relation to this incident."
Twitter, now called X, temporarily restricted verified accounts after that 2020 breach.
The man behind the July 2020 hack, UK national Joseph James O'Connor, was arrested in Spain in 2021. Spain's High Court ruled that the United States was the best place to prosecute him because the evidence and victims were there. O'Connor was extradited and pleaded guilty in the U.S. to charges including computer intrusion, wire fraud, and extortion.
He was sentenced to five years in prison in 2023.
The financial fallout extended beyond the criminal case. Britain's Crown Prosecution Service announced last year that it had obtained a civil recovery order to seize 42 Bitcoin and other crypto assets linked to the scam, a haul equating to $5.4 million.
Prosecutor Adrian Foster framed the asset seizure as a message:
"We were able to use the full force of the powers available to us to ensure that even when someone is not convicted in the UK, we are still able to ensure they do not benefit from their criminality."
The latest breach raises a straightforward question: Why was a high-profile government-affiliated Instagram account, already compromised once in a major international hacking incident, left dormant and apparently unsecured for years?
Meta says it locked things down after the fact. But there is no public explanation of how the hacker gained access, how long the unauthorized content was visible, or what steps, if any, were in place to protect an account that still carries the name of a former president and the White House itself.
No one from the Obama orbit has commented publicly. Meta has not disclosed whether the account had two-factor authentication enabled or what security protocols applied to legacy government-linked pages.
The @obamawhitehouse account is not some obscure personal page. It is an official account tied to a former administration. It carries institutional weight, even if the last legitimate post is eight years old. Leaving it exposed is the digital equivalent of leaving the front door unlocked and the lights off.
High-profile account breaches are not new, and the pattern is familiar. Hackers find neglected or poorly secured accounts belonging to prominent figures or institutions. They exploit the trust those accounts carry, whether to push cryptocurrency scams, spread provocative content, or simply cause chaos.
The 2020 hack cost real people real money. O'Connor's scheme netted millions in crypto before law enforcement caught up. The five-year sentence and $5.4 million asset seizure were meaningful consequences, but they came years after the damage was done.
This latest incident did not involve a financial scam, at least not one that has been reported. The content was memes and an AI-generated image. But the vulnerability is the same. And the failure to secure the account after the first breach makes the second one harder to excuse.
When institutions leave doors open, someone will walk through them. The question is whether anyone on the other side of that door plans to install a lock this time.
