Here's the Cease and Desist Facebook Sent to 'OG' Account Thieves

On Thursday, Motherboard reported Instagram had unmasked a number of members of the OGUsers community, a nebulous group of sellers, middlemen, and hackers who trade in social media and gaming usernames, and sent some of them cease and desist letters. Instagram also disabled hundreds of accounts of those in the community, and TikTok and Twitter took similar action.

Now a section of the cease and desist Facebook, which owns Instagram, sent to OGUsers members shows more explicitly what the company is demanding of individual users, including not using Facebook or Instagram at all.

"Please respond to me WITHIN 48 hours confirming that You: Have stopped and will not in the future access the Facebook and Instagram websites and/or use Facebook's and Instagram services for any reason whatsoever," the section of the cease and desist obtained by Motherboard reads.

A member of the OGUsers community shared the document with Motherboard, and Instagram said it appeared authentic as an excerpt when provided with a copy for verification purposes.

The cease and desist also tells the recipient to confirm that they "Have preserved and will continue to preserve in the future all information related to the activities described herein;" "Have shut down any and all websites you operate that are used to offer services related to Facebook or Instagram, and have removed all advertisements or postings on external websites advertising or describing Your services related to Facebook or Instagram;" and "Have stopped and will not in the future offer, transfer, market, sell, or offer to sell any services related to Facebook and Instagram."

Facebook tells the recipient to "account for and disgorge any and all revenue" earned from the unauthorized activities.

The document adds that "Facebook has taken technical steps to deactivate your Facebook and Instagram accounts, and hereby revokes your licenses to access Facebook and Instagram."

The cease and desist also tells the recipient that their activities may violate federal and state laws, including the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act. It also implies that any continued access by the recipient of Facebook or Instagram services could be perceived as a criminal act, adding that "Facebook will treat any further activity by You on its websites, mobile applications, Platforms, services, or networks as intentional and unauthorized access to its protected computer networks."

For years, OGUsers members have sold, traded, and broken into social media accounts which are sometimes worth thousands of dollars. Members use SIM swapping, extortion, and phishing to hack into accounts, as well as automated tools to grab usernames that become available.

After the initial Instagram action, Motherboard saw multiple users on the OGUsers forum complain of their Discord accounts also being banned. Discord then told Motherboard that it had permanently banned a number of Discord accounts related to OGUsers because of their involvement in illegal activity. Discord said that because of the sensitivity of the actions and ongoing investigations it did not have anything to add.

As Motherboard reported on Thursday, one of the accounts Instagram disabled belonged to an OGUsers middleman who used the handle Farzad.

"I help people deal safely, that's all," they said, and added that they were speaking to their lawyer.

Subscribe to our cybersecurity podcast CYBER, here.