Illinois Man Pleads Guilty in Large-Scale Snapchat Phishing Scheme Targeting Women
A 27-year-old Illinois man, Kyle Svara of Oswego, has pleaded guilty to a phishing and account-compromise operation that targeted thousands of Snapchat users, resulting in the theft of private images from hundreds of women. Svara admitted to charges including aggravated identity theft, wire fraud, computer fraud, conspiracy, and making false statements related to child sexual abuse material. His sentencing is scheduled for May 18, 2026.
Between May 2020 and February 2021, Svara executed a social engineering campaign, collecting victims’ email addresses, phone numbers, and Snapchat usernames. He then triggered password-recovery requests, prompting Snap Inc. to send legitimate security codes to users. Posing as a Snap representative using anonymized phone numbers, Svara texted victims to request these codes a tactic that bypassed direct authentication controls by exploiting human trust.
Authorities reported that Svara contacted over 4,500 individuals, with approximately 570 women providing their access codes, granting him unauthorized entry to at least 595 accounts. Once inside, he downloaded nude or semi-nude images, which he later retained, sold, or traded on internet forums and private platforms. Prosecutors revealed that Svara advertised his services online, including on Reddit, where he claimed he could "get into girls’ Snap accounts" for buyers or trading partners.
The scheme was linked to Steve Waithe, a former Northeastern University track and field coach, who allegedly hired Svara to compromise accounts belonging to women he coached or knew. Waithe was convicted in November 2023 on charges of wire fraud, cyberstalking, and computer fraud, receiving a five-year prison sentence in March 2024.
In addition to Waithe’s targets, Svara pursued women in Plainfield, Illinois, and students at Colby College in Waterville, Maine. During an investigation, Svara initially denied involvement in Snapchat hacking and claimed he did not seek child sexual abuse material. However, authorities determined he had collected, distributed, and solicited such content.
The case underscores the risks of SMS-based verification, where account-recovery features designed for legitimate use can be exploited by attackers through social engineering. The FBI has encouraged potential victims to report incidents through its victim-assistance portal.
Source: https://gbhackers.com/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users/
Snap Inc. cybersecurity rating report: https://www.rankiteo.com/company/snap-inc-co
"id": "SNA1784903395",
"linkid": "snap-inc-co",
"type": "Breach",
"date": "5/2020",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Over 4,500 individuals '
'contacted, 570 women provided '
'access codes, 595 accounts '
'compromised',
'industry': 'Social Media/Technology',
'location': 'Global (U.S.-based)',
'name': 'Snap Inc.',
'type': 'Company'},
{'customers_affected': 'Women coached by Steve Waithe',
'industry': 'Education',
'location': 'Boston, Massachusetts, USA',
'name': 'Northeastern University',
'type': 'Educational Institution'},
{'customers_affected': 'Students',
'industry': 'Education',
'location': 'Waterville, Maine, USA',
'name': 'Colby College',
'type': 'Educational Institution'},
{'customers_affected': 'Women targeted by Svara',
'location': 'Plainfield, Illinois, USA',
'name': 'Plainfield, Illinois residents',
'type': 'Individuals'}],
'attack_vector': 'Social Engineering, SMS-based Verification Exploitation',
'customer_advisories': 'FBI encouraged victims to report incidents via '
'victim-assistance portal',
'data_breach': {'data_exfiltration': 'Yes (images sold/traded on internet '
'forums and private platforms)',
'file_types_exposed': 'Images (nude/semi-nude)',
'number_of_records_exposed': '595 accounts compromised, '
'hundreds of private images '
'stolen',
'personally_identifiable_information': 'Email addresses, '
'phone numbers, '
'Snapchat usernames',
'sensitivity_of_data': 'High (intimate images, PII)',
'type_of_data_compromised': 'Private images (nude/semi-nude), '
'personally identifiable '
'information (email addresses, '
'phone numbers, usernames)'},
'description': 'A 27-year-old Illinois man, Kyle Svara, pleaded guilty to a '
'phishing and account-compromise operation targeting thousands '
'of Snapchat users, resulting in the theft of private images '
'from hundreds of women. The scheme involved social '
"engineering to bypass Snapchat's password-recovery system and "
'gain unauthorized access to accounts.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'Snapchat due to exploitation of '
'account-recovery features',
'data_compromised': 'Private images (nude/semi-nude), personally '
'identifiable information (email addresses, '
'phone numbers, usernames)',
'identity_theft_risk': 'High (account access, personal data '
'exposure)',
'legal_liabilities': 'Aggravated identity theft, wire fraud, '
'computer fraud, conspiracy, false statements '
'related to child sexual abuse material',
'systems_affected': 'Snapchat user accounts'},
'initial_access_broker': {'data_sold_on_dark_web': 'Private images '
'sold/traded on internet '
'forums and private '
'platforms',
'entry_point': 'SMS-based password-recovery '
'requests',
'high_value_targets': 'Women (students, athletes, '
'residents of specific '
'locations)',
'reconnaissance_period': 'May 2020 – February 2021'},
'investigation_status': 'Guilty plea entered; sentencing scheduled for May '
'18, 2026',
'lessons_learned': 'Risks of SMS-based verification and social engineering in '
'account-recovery processes; need for multi-factor '
'authentication and user awareness training.',
'motivation': 'Financial gain, distribution/trading of private images, '
'personal exploitation',
'post_incident_analysis': {'root_causes': 'Exploitation of human trust in '
'SMS-based verification, lack of '
'multi-factor authentication, '
'social engineering tactics'},
'recommendations': 'Implement stronger authentication methods (e.g., MFA), '
'educate users on social engineering risks, enhance '
'monitoring of suspicious password-recovery requests.',
'references': [{'source': 'U.S. Department of Justice'},
{'source': 'FBI Victim Assistance Portal'}],
'regulatory_compliance': {'legal_actions': 'Aggravated identity theft, wire '
'fraud, computer fraud, '
'conspiracy, false statements '
'related to child sexual abuse '
'material'},
'response': {'communication_strategy': 'FBI encouraged victims to report '
'incidents via victim-assistance '
'portal',
'law_enforcement_notified': 'Yes (FBI, prosecutors)'},
'threat_actor': 'Kyle Svara (individual), Steve Waithe (co-conspirator)',
'title': 'Illinois Man Pleads Guilty in Large-Scale Snapchat Phishing Scheme '
'Targeting Women',
'type': 'Phishing, Account Compromise, Identity Theft, Wire Fraud, Computer '
'Fraud, Conspiracy',
'vulnerability_exploited': 'Human trust in SMS-based password-recovery '
'requests'}