Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Millions of Instagram influencers had their contact data scraped and exposed (techcrunch.com)
244 points by idlewords on May 20, 2019 | hide | past | favorite | 152 comments


This makes me wonder: How many Instagram influencers are there in total? What is the percentage of influencers in the entire population of (active) users? At some point it's just influencers influencing each other, right?


There are actually multiple levels of (Instagram) influencing. On the one end you have your mega influencers like Kylie Jenner. On the other there, are so called nano influencers, with as few as a thousand followers (and up to 10k). Usually, the fewer followers you have, the more engagement you can get from your followers and that's something companies will pay for. Also, most nano influencers are just doing it as a side gig for some free stuff, so it might actually be kind of economical as a marketing channel for many consumer companies (YMMV of course).


Yeah, "nano influencer" is basically the Avon lady/Tupperware party host of this decade.


Anecdotally, I know multiple people who's followers count would put them in the category of "nano influencer" who do an excellent job using their platform to engage with interested clients / paying customers.

I guess because of this one might not refer to them as purely an "influencer" but more and more people I know use instagram as a primary platform for advertising skills / wares as well as a place to spend money.

If you know your audience spends time on instagram, you'd be stupid not to put resources into engaging with them on the platform.


>I guess because of this one might not refer to them as purely an "influencer" but more and more people I know use instagram as a primary platform for advertising skills / wares as well as a place to spend money.

Yeah, I had absolutely no interest in the platform until I learned of some shoe makers communicating/selling only through it. It seems to have become a very popular showcasing platform for crafts.


"Anecdotally, I know multiple people who's tupperware parties count would..."

I am not talking trash about your point. Just that you replied to a comment with not much understand of multi level marketing (pyramid schems) that the previous comment was aluding to (and the commenter didn't expand on it either). Most people in the tech business do not have much exposure to it. But the success of things like herbalife, avon, etc rest on the "marketing reach potential" of their network, not just for the direct product.

so in a way you are confirming the similarity that you thought you were denying with your comment. And the great insight here is how "influencer" is a kind of organic-multilevel-marketing scam.


Other than your suggestion that a "nano-influencer" is akin to MLM (in the whole up/down graph stuff, and pyramid nature), I don't see reason here to conclude that.

Small-to-medium brands engaging with small-to-medium scale individual marketers/influencers could be quite different than traditional MLM, with way fewer intermediaries.


The problem with MLMs was the predatory nature: having friends suck eachother into them to earn referrals, and most of the product being sold to people with dreams of getting rich with "cheap" and exclusive prices, who will in turn have a hard time finding actual customers to consume it.


The main differentiating factor is whether the "distributors" are the customers (as is the case with a lot of MLMs, around these days) and real sales to end customer only make up a small percentage of total sales. In those cases all the product ends up in garages and attics of the people who bought in and now can't sell because the product is overpriced shit and designed as such. That means the primary way to make sales is to recruit new "distributors" who then have to do the same (so, pyramid schemes).

However things like tupperware didn't seem to work that way, the product was actually mostly sold to end customers which makes it a legitimate business and not a pyramid scheme.


> ... of organic-multilevel-marketing scam.

Is it a scam though? A pyramid scam is self-similar: you sell to people who then expect to sell to people who expect to sell to people etc.

I thought Avon, Tupperware etc. had a fixed length chains and multi-decade track records of sales to real consumers at the end of the chain.


It's not a recursive scam, but some of them are still situations where they convince people to buy in before they understand the demand, and then in order to recoup their costs they now have to resort to obnoxious techniques like inviting their entire Facebook contacts list to their virtual party. I think the term "scam" is removing the resellers from responsibility for their own situation, so "sham" is a better term. Others aren't scams at all, but simply business that usually involve obnoxious techniques like inviting your entire Facebook contacts list to your virtual party.


That is both a cogent and hilariously accurate description.


cogent? whats that mean?


A clear and convincing argument


Heads up: If you're using Chrome, you can highlight a word, right click / context menu, and the very first option will be "Look up <word>".


Great insight! I’m stealing this.

Was also surprised to learn these are still a thing outside the US


As in, a microbusiness connecting with a group of dedicated customers? Sure.


Oh man those are even worse. Arbonne is this decades mary kay.


does the MLM thing actually work for all that sign up? i never got into them


This article goes into just how much you can make as an influencer:

https://www.vox.com/the-goods/2018/11/28/18116875/influencer...

From the article:

> What do influencers charge per post?

> It depends on the influencer, and their follower numbers. A micro-influencer, which is someone that has 10,000 to 50,000 followers, is actually pretty valuable. They used to only pick up a couple hundred bucks, but today, they get a minimum of a few thousands dollars a post.

> Influencers with up to 1 million followers can get $10,000 [per post], depending on the platform, and 1 million followers and up, you’re getting into territory where they can charge $100,000. Some can even get $250,000 for a post! Especially if the content is on Youtube and the influencer is in the gaming industry.

> How much do typical influencers make annually?

> People with smaller followings [who are known as nanoinfluencers] can make between $30,000 and $60,000 a year. The micro-influencers can make anywhere from $40,000 to $100,000. Celeb influencers make way, way more.


2c from someone that knows:

assuming 30%+ US & 10%+ likes to followers ratio & 50%+ female

$250K per post is Kylie Jenner's territory.

A girl with 1.5MM and some connections can make up to $500K/y. About $5K per post. About 10MM impressions.

Someone with 500k can make up to $200k a year. Around $2k per post.

If your audience isn't as the one I described, the prices drop considerably. Rare exceptions apply.

Note that unless your "influencer" is a singer or an athlete or a politician or royalty, they're not "influencing" anyone. just treat them as pure ad impressions.

If you're paying more than $2K per 1MM impressions of the audience I described above, you're doing something wrong. Unless it's a singer or an athlete or a politician or royalty. In that case up to $2.7K makes sense


> 10%+ likes to followers ratio

is there a standard metric to check how many of your followers are active?

if you have 1.5mm followers, but the same 10% on average are the ones to engage/like your posts, is it the same as having 15,000 really engaged followers?


10% of 1.5MM it's 150,000. Not 15,000.

Also, Instagram simply doesn't show your stuff to 100% of your followers 100% of the time, so it's just impossible.

If you were to ask, could an 800K account with 150.000 likes per post charge as much as an 1.5MM account with 150.000 likes per post? Yes, and it would make sense. It's just rare that someone has an higher than 10% ratio. I've seen them upwards of 20% with the current algo.

As I said, as an advertiser you should look to pay about $2K per 1MM impressions (which are about 50k likes). In other words, if you paid $2K to get your product posted on an account with the audience I described previously and it gets 50K likes, you're doing it right and you're supposed to make a profit.

$2K per 1MM impressions it's my opinion tho (and it's pretty market average in my experience). It's derived from the fact that you can pay $3.5K to FB directly to get 1MM female US impressions on IG - with zero hassles and better traceability.


> It's just rare that someone has an higher than 10% ratio. I've seen them upwards of 20% with the current algo.

Is it 10% for any one post?

My question is, in a rolling 30 day period, are 10% of all followers overall liking posts, or any given random 10%?


From 12 years of adtech experience, this is absolutely false.


what do you think the correct numbers are?


$5 per 1k followers average, so $500 per post for 100k followers, sometimes split with a talent agency/network that takes a cut. Smaller accounts are worthless but might get bought as a bundle. $1k+ per post needs 1M+ followers.

$25k+ per post is just normal celebs. $250k on a social media post is extreme and only happens if the person is incredibly famous. It's no different than tv commercials and sports deals. Nothing has really changed other than adding a new medium to monetize. The fame is still the hard part, although there's more of it to go around and more opportunity for those that try.


Like written down below, fractions of those are probably correct. Have been involved in making a deal with an influencer with around 50k followers. Was around $400 for a single post.


I'm really interested to know how companies can measure ROI on influencers, the spend > conversion flow just doesn't make sense to me.


it's not that hard.

- custom/tracked coupon codes

- custom/tracked swipe-up or bio links

- general increase in sales for the day

Instagram ROI for consumer products is good enough that the tracking doesn't need to catch 100%.


did you see that documentary on netflix, burning man? can't remember, they lost everyones money and were paying influencers, like, $200,000 bucks a post..if i'm wrong about the festival name i mean no disrespect.


I think you mean Fyre festival, if so the documentary you're referring to is probably "Fyre: The Greatest Party That Never Happened"


Holy shit!


Save your enthusiasm, those are the fakest numbers I've ever seen. Divide them all by 50. Source: I've paid for a bit of influencer marketing.


To elaborate to the sibling commenters. Kendall Kardashian got 250k to post to 110MM followers on IG, and it was a scam, so was probably overpaid. But that's 110X what the other comment claims for the going rate.

Just contact some IG pages and see what they are willing to accept. The proliferation of meme pages, fake likes, news feed algos that decide what to show you, everyone wanting to become an influencer, and general inflation (1MM followers is nothing these days) have driven down costs. It's a bit of a lemon market too. I paid around 1/50th or 1/100th of the figures quoted in the other comment. Ofcourse it varies though.


By 50 is equally out of reality, as they are much higher.

>I've paid for a bit of influencer marketing.

Rates depend on the influencer, demographic, industry, and many other factors.


1-10 million impressions isn't $250 000.


What if you're a casual instagram user and you end up with 10k followers? But you're not doing anything except posting regular pictures/stories/etc - zero engagement, zero working with any other company/etc.

Would you still be counted as a nano influencer?


That rarely happens because most Instagrammers invest hundreds of hours of grinding work to get their followers (post frequency, posting at a certain times and days, deleting non-performing posts, obsessed with making it to the Explore page, etc). I guess that less than 1% of users with >10k followers got there "naturally".


... or just buy them like that guide that was on front-page


Most of my friends who are good at skateboarding or surfing have 2-15k followers, regardless of whether or not they're sponsored.

They do almost no personal branding, they're just well-known in their area. I imagine it's the same for most sports with a lot of participants, save those with a high financial barrier to entry (e.g. racing cars).


Or maybe the market is niche and it's not about the size of the follow count but the quality.

Ex: I don't have an instagram currently, but if I did I'd bet I'd have better chance of selling wireless pineapples than even a "megainfluencer" like Kylie Jenner.


No I'm pretty sure Kylie Jenner could sell millions of dollars worth of wireless pineapples tomorrow if she wanted. She could just ask her fans to buy them as a favor to her. and techies follow hot girls too so they'll see the post anyway.


>techies follow hot girls too

That's a pretty broad statement, not all "techies" are straight males.


Probably depends how you define "influencer." I remember reading a few months ago about "fake" influencers who aren't getting paid but pretend to shill products anyway so people think they are an influencer.


Wow, so they're basically pretending to be marketers, as a marketing move to market themselves to marketers, in hopes of becoming marketers?

If there's a point on the spectrum that's more "meta" and further away from the idea of "connecting & sharing with friends" I don't know what it is. Maybe it would be whoever's out there marketing themselves as fake followers to help would-be marketers market themselves to marketers? Or marketing themselves as marketing coaches to help would-be marketers market to marketers? You know they're probably out there.


It may not even necessarily be to become marketers. There are certain positive implications about attractiveness and coolness associated with influencers, so some people may just want their "friends" (who are their actual followers) to think that they're influencers.


>Wow, so they're basically pretending to be marketers, as a marketing move to market themselves to marketers, in hopes of becoming marketers?

Isn't that the ages old, "fake it till you make it"?


This is sad. Are these children or adults? Do they have careers and do this as a side gig?


It is very difficult to get a decent job for many people, perhaps they see it as an opportunity for such.


That is old news, been going on for years. Probably a good chunk of the so-called influencers is just such as the once you point out.


Isn't this like the majority of marketing though. Fake it till you make it?


The user numbers are probably grossly exaggerated by bots.

I get a feeling the news feed of long time users get so spammy that "real content" gets lost.

I've made a twitter account for my niche real estate statistics site and the amount of answer I get from people that are following many users is minuscule. People with less followers are more prone to answering.

(NB: I'm not spamming my site to them, but like trying to talk about estate prices with people that are talking about real estate prices).

It's like what I write disappears when writing to those people. Twitter feels like a place where user involuntarily stalk the elite rather than a social network. Instagram the same thing.

The feed algorithm is hugely favoring algorithmic "friends" and popular users, most likely.


> Twitter feels like a place where user involuntarily stalk the elite rather than a social network.

I've often felt similarly. Twitter has always seemed more of a "broadcast" type of network, with personalities/small companies doing the "interact with users" thing only until they make it big, at which point it becomes all advertising, all the time.


Everyone and their grandmother is an "influencer" on Instagram. Sounds so cringey.


> How many Instagram influencers are there in total?

Having worked in this space back in 2010, I can say that at the time about 150 million Americans had a blog, but only about 10,000 had 10,000 or more subscribers. The numbers are bigger now with the popularity of platforms like Twitter / YouTube / Instagram / Twitch, but only a few times bigger, not orders of magnitude bigger.


Half the entire population had a blog?


Think of all the people who had accounts on Live Journal, Blogger, Tumblr, etc. It used to be much easier to create a blog than it is today.


it's even easier to blog now

just make an instagram

it's harder to stand out


yeah


Yeah, nah...

Probably more accurately maybe 10% of the population had 10 or so abandoned blog-starts. (I've never "been a blogger", but I'm sure there's remnants of at least 5 or 10 failed attempts on my part to become one - littered in archive.org, search engine indexes, and web hosting that's not yet expired...)


I love how we're all just using this invented marketing term "influencer" as if it's actually a real thing (it is not a real thing).

It is slightly less obnoxious than just calling it "first class" vs. "commoners" instagram, but still pretty obnoxious nonetheless.


> I love how we're all just using this invented marketing term "influencer" as if it's actually a real thing (it is not a real thing).

That statement is ridiculous to me - actually more ridiculous than I find the whole "influencer" culture in the first place.

"Influencer" absolutely is a real thing. The reason brands are willing to pay many thousands of dollars to get something as simple as a tweet, story or post about a product is quite simply because it works. On the other side, Snapchat lost $1.3 billion in valuation when Kylie Jenner tweeted "sooo does anyone else not open Snapchat anymore? Or is it just me... ugh this is so sad." Seems like "influencer" very accurately describes the role.


Famous people with influence have existed for centuries. There's nothing new here, other than more people claiming they can do it with fake numbers and the rise of talent agencies 2.0.


> Famous people with influence have existed for centuries. There's nothing new here

Baloney. How many teenagers could make literally millions of dollars in centuries past based primarily on their relatability (in addition to their video game or makeup application skills). Modern social networks and YouTube have opened up an entirely new way not to just have influence, but to monetize, productize and quantify it.

I get it, you probably think it's all dumb and pointless, but to say it's "nothing new" is like saying the internet is nothing new because people have been sending messages back and forth for centuries.


"Influencer" is just a buzzword. Influence itself is not a new concept. Fame is something that provides influence, and can be gained by being recognized for something and growing a following.

Sure there are new avenues to create and connect with people to gain that recognition, along with increased opportunity from a bigger population and lower costs, but how fame works and the monetization of that fame is a very old concept. There's nothing new there.

Study the principals, not the buzzwords. You can find all this in a 50 year old marketing book.


Yes, i can see a Roger Corman movie about it now..Attack of the Crab Monsters Part 2 hides behind a tree not that i've watched it all, i like Bruce Willis and Arnold Schwarzeneggar films


I recall reading Malcom Gladwell's description of "Social Connectors" from back in 2000, and realising it accurately describes a few of my friends/acquaintances:

"Connectors are the people in a community who know large numbers of people and who are in the habit of making introductions. A connector is essentially the social equivalent of a computer network hub. They usually know people across an array of social, cultural, professional, and economic circles, and make a habit of introducing people who work or live in different circles."

I think today's "influencers" are similar but perhaps more shallow versions of Gladwell's "Connectors".

I know if _I_ ask a question social media, I'll mostly get an answer if any of my friends know the answer. But when - for example - jwz asks "Dear Lazyweb", he'll get the guy who wrote the linux kernel subsystem or who runs the datacenter he's having problems with explain what's going wrong (often after having fixed it).

The concept of some people being well connected enough to reach and influence a valuable number of important-in-some-context people is 100% "real". (Whether an attractive blonde showing off a specific brand of sunglasses or luggage in Instagram qualifies is questionable, part of me wants to say "Nope!", but I don't make my living trying to convince people to buy my brand of sunglasses or luggage, so what do I know?)


The word itself is a touch cringeworthy but the fact that the term is now ubiquitous should really be a hint of how big this phenomenon is.

If you are unable to see the value in influencers (from a business perspective) it would simply suggest you are part of a segment that aren't engaged by them. If so don't let that fool you into underestimating the effect these people are having. Their audiences are highly engaged and are the same people who don't watch any TV and have adblock installed.


No you are totally right, I'm sort of aware of their power. I'm just pointing out how obnoxious it is that we just stratified online websites into the elites and the commoners and invented terms for them to make people feel as special as when they fly first class. This is a new thing that happened all of a sudden in the past few years.

It's an ugly trend taking over everything. Stratify all humans, treat the elites differently. Forget about net neutrality, we can do this within websites, within APIs, and so now we do.


I believe it is more of a 'use case' of the platform. Personally, I abhor and avoid anyone who sells paid advertising slots within their 'natural' photos, but I get that there are some people who will deliberately do this for $$$, and that there are product manufacturers who will pay people with an audience to do this.

I tend to follow niche manufacturers (of guitars or other handmade instruments) directly because I am interested in their 'behind the scenes' photographic essays. No need for me to see them draped over someone who has no idea about the product but will happily drape them over themselves at some ubiquitous beach sunset shot.

I don't think it is a 'class' thing as much as it is a 'positioning' thing.


> Personally, I abhor and avoid anyone who sells paid advertising slots within their 'natural' photos ...

From HN's FAQ:

> Another kind of job ad is reserved for YC-funded startups. These appear on the front page, but are not stories: they have no vote arrows, points, or comments.

(I don't _like_ it, but it's kinda part of choosing to use someone else's free service and the community it builds. They get to choose the rules, including who gets to monetise that community and how...)


Those ads aren't natural photos, or any other kind of photos.


Perhaps it's just the Uberization of celebrity?

Anybody can download an app and do celebrity (read "taxi driver") stuff, and cash in on the gig-economy celebrity market...

I wonder how long until we see a court case claiming "influencers"should be given employee benefits by Facebook???


If you see all influencers as "elite" then that's your personal perception. They're just different types of users. To me, the influencer with 50 followers is less elite than the casual user who has thousands of followers just by sharing photos intended for friends and family.


Don't knock flying first class. There's nothing wrong with getting to a point where you value less torture in the air more than the amount of money it costs. This isn't a class warfare issue.


I think airline cabins are absolutely the best example of a class warfare issue, especially since so many other industries are trying to copy the cabin stratification model.

If that's not a good example of different classes rubbing up against eachother and getting angry about it then nothing else on the planet is, either.

You know that coach used to be better than first class is now, right? This idea that the back of the plane is bad and horrible suffering is a new invention, a new construct of the airlines that everyone just bought into all at once.


It's just a job like anything else. Since forever word of mouth advertising was the most valuable and this is just a natural evolution of it since people spend a lot of time on social media.


They’re advertisers, but (mostly) without the contract, steady income and outright obviousness to their target audience.

Traditional ads are marked as ads and given generally separate spaces. This generation is all about “normal” people trying to organically influence people to buy some company’s cheaply made shit. It’s a real thing and it’s working.


Some people are making money off of it. It may be frivolous or vacuous or derided, but someone is willing to pay for the phenomenon and “platforms” are making money of this belief as well.


They are advertisers. The same way you'd see people on TV ads saying how this new shampoo made their hair perfect or how this new toothpaste got rid of years of caffeine stains on their teeth.


Or shill.


Yeah, these people have always been known as shills, sell-outs and charlatans.

'Influencer' is new-speak trying to hide their shadiness.


That seems unnecessarily harsh. In most cases it is quite clear which post is sponsored and which isn't. Are podcasters with ads sellouts too?


> Are podcasters with ads sellouts too?

Depends what they are shilling and whether the creators of the show would actually endorse those products themselves genuinely.

Like, I personally wouldn't have an issue endorsing something that I use myself, but I would absolutely be a sell-out if I did it just for the money. I'm not a salesman.


>In most cases it is quite clear which post is sponsored and which isn't.

It depends on where you set your bar. For some individuals (probably the bulk of Fyre Fest attendees) this is going to require explicit text.


[flagged]


Only in the same way as "entrepreneur" is...

Instagram "influencers" are just side-hustling with what they've got at their disposal, it's quite possible that if they were writing iOS apps as a side hustle instead we'd be championing them here...


> if they were writing iOS apps as a side hustle instead we'd be championing them here

If that were the case, I'd wager there'd be a similar number of "BrandonM" style comments about how what they're building "doesn't need to be an app" and was how they could have made a better version over the weekend.


I am also wondering ho many techniques - or tropes - there are that go with the territory. I am thinking of archiving the classics of each type. The stupid giveaways, the cliched food pictures, the whole lot needs to just have the definitive versions of each genre catalogued.


> What is the percentage of influencers in the entire population of (active) users?

To an extent, everyone is an influencer: if you tell another person about an experience you had, you were influencing them. In other words, influence is an analog scale, not a binary switch.

As for how influence is distributed, influence is a secondary property of a person, that is to say that one's success at being an influencer is dependent on other secondary properties (skill at writing, photography/videography skills, etc.) and primary properties (sexual attractiveness being a big one).

Since it is a secondary property, the distribution will look like a logarithmic distribution (it may not actually be a logarithmic distribution, but the general shape will be correct, as opposed to a Gaussian distribution, for example).


> Security researcher Anurag Sen discovered the database and alerted TechCrunch in an effort to find the owner and get the database secured.

Wouldn't it make more sense to contact AWS, who presumably has the contact info of the owner?


AWS does not provide Anurag Sen with any exposure/advertising. (Note: I don't think this is wrong. Everyone has to earn a living)


This may in fact be the right answer. Which is sad if true.

Unless he tried AWS first and got nowhere. Then Techcrunch would be a reasonable place to go.


According to the article the security flaw was just that the DB was not secured with any password. There could be a legitimate reason for that and it's not a flaw in the technology, so it's really not something AWS should be doing something about (other than maybe reaching out to the user to confirm that the lack of password is intended).

Honestly, I would be a little worried if AWS saw that a user had a DB with no password and decided to either add a password or block access to the DB without the user's consent.


I wouldn't expect AWS to do anything like that. I'd expect AWS to understand the implication of a database of private data being publicly accessible and having the account rep reach out to the owner and let them know.


Security influencer Anurag Sen announced on his twitter feed... /s


It should be noted that most of this data (including emails and phone numbers) is published publicly by the influencers themselves. This headline is clickbait. Thousands of scrapers are constantly running all around the world, scraping any data that you choose to make public on social networks. Don’t make your phone number or email public if you don’t like this.


Clickbait implies that this is intentionally deceptive. I think this is just uniformed reporting. This is made even more clear from this tweet by the author: https://twitter.com/zackwhittaker/status/1130525216038359041 "What's curious here is that the data contained non-public data — including phone numbers and email addresses of associated Instagram accounts — which, logic suggests it could've only gotten from Facebook."


I would like to know the phone number and location though.


Many influencers include this info in their bio.


Interesting... Some of the "influencer search" platforms eg heepsy allow users to download a limited number of email/phone details for influencers. I always wondered how they managed to get this info in bulk to begin witht


I mean just like Twitter data is public, I always assumed that public Instagram profiles are public data too. Everyone can see their posts, likes, comments, followers and following, so what stops a computer from doing so?

Update: it's against FB's T&C to scrape and store this publicly viewable data. Quite convenient, they'll only sue / take action when a rule breaker becomes non-trivial in size or a nuisance


How is Techcrunch able to figure out the owner of this database, and why did the researcher expect them to be able to?

> Security researcher Anurag Sen discovered the database and alerted TechCrunch in an effort to find the owner and get the database secured. We traced the database back to Mumbai-based social media marketing firm Chtrbox


> How is Techcrunch able to figure out the owner of this database, and why did the researcher expect them to be able to?

Relationships in the industry and resources.


As in someone at AWS leaked private account information?


Using journalism?


It seems that the data was not all public, so this was more than just aggregated scraped public info.

So that means Chatr did some combination of:

- Directly exploit the Instagram API bug before it was patched

- purchased the leaked data from a 3rd party

edit: formatting


> At the time of writing, the database had over 49 million records — but was growing by the hour.

This implies it's still going, so not related to the patched bug.

Which begs the question... how are they now, currently, scraping and adding people's phone numbers from public accounts?


Due to lack of strong data protection law in India and awareness, I won't be surprised if its been purchased from a 3rd party.

There are some "Indian startup" groups on Facebook, where it's common for people to sell such databases, and nobody asks if the seller has consent from the people in the database. Such posts also never gets taken down, or the seller doesn't get blocked from the group.


Naive question - What is the process like for a security researcher to go about 'discovering' an open database like this?


Start with running scans using shodan.io. Dig through results, start fine-tuning your searches and automating the digging.


I’d imagine it starts by port scanning known AWS IP blocks.


Isn’t this illegal? What happens if the owner decides to press charges instead of being thankful?


You get so many scans, failed logins that you can never press charges against them all. Imagine the reaction of law enforcement if you show up with 10 000 login attempts per day and you want to press charges.


It speaks a lot to modern culture that "influencer" is a thing. Every article I've read about influencers, the majority sound like entitled, spoiled, children.


Couldn't the same thing be said about '90s grunge/alternative bands and rap/hiphop groups? They were "influencers" as well, with a clear impact in art and fashion. And they crafted their legend in part by wrecking hotel rooms, arriving hours late to shows and making public spectacles of themselves.

The common thread among them is that they were polarizing. It was OK that lots of people hated them and would never buy anything they were pitching, as long as there were thousands of others who went the exact opposite way and bought in to the whole charade.


There's these entire ecosystems of people involved in something that most everyone I know couldn't care less about. I don't think I've ever been on Instagram, and I wouldn't go to Coachella if it were free. I have a Twitter account, but mostly because I use them for oauth in a lot of apps. It's boring and I don't put much stock in celebrities or "journalists".

I guess I'm jealous that many of them translate their online importance into a lot of money. But what they're spending their life doing is incredibly lame. Unless you're influencing people to give blood or vaccinate their kids, then it's just a huge jerk-off.


Wow, there are millions of influencers? Some must be influencing just 1-5 people I guess then.


The audiences for different influencers can overlap. I guess even the smallest influencer I've seen have audiences of at-least 1K to be taken seriously.


isn't that what they want? how else can they influence if they're not contacted..


How is this a story? The contact information is available, people and companies scrap the web all the time. There are tools and libraries for that purpose for any programming language. What's so surprising abut this piece of news then?


> each record contained public data scraped from influencer Instagram accounts, including their bio, profile picture, the number of followers they have, if they’re verified and their location by city and country, but also contained their private contact information, such as the Instagram account owner’s email address and phone number.

They make a point to note that some of the contact info exposed wasn't public.


Sloppy reporting. Email & phone number are available for Instagram accounts linked to a business profile: "Business Profiles include a Contact button near the top of their profile. You'll be able to include directions, a phone number and / or an email address. Keep in mind that you must include at least 1 contact option when setting up your Business Profile."


If you follow some links it wont take you long to find your favorite celebrity's personal cell phone number. I think that's kind of a story.


That's very unlikely. The article is misleading in that the reporter seems to believe that emails / phone numbers are never exposed by Instagram. In fact "influencers" typically choose to set up an Instagram Business Profile containing email and / or phone number. So this is almost ceratinly public information that was scraped, not private information obtained via a breach. Assuming your "favorite celebrity" is a movie star, popular musician, etc, any contact info is very likely for their social media manager, not for them personally.


Don't get this.

All influencers and wannabes on IG expose their email in their about section on purpose.

Crawling them incl. further specs like followers, posts is the first thing every Instagram marketer does/should do.

Before GDPR, there was even an open API which gave everything out.


Looks like nearly 50 million accounts have been exposed. That's an alarming amount.. most of which Chtrbox had obtained/scraped themselves without the account owners knowing.


According to the recent LinkedIn court case, it's legal (at least in US)

https://arstechnica.com/tech-policy/2017/08/court-rejects-li...


This looks like the perfect time for some of the EU-based influencers to raise a GDPR infringement request against Chtrbox. They collected the geo-location of the people, so the company should've known they would be liable.


micro influencers, the data's useless.. it's against Facebook T's and C's to scrape from Instagram.


Birmingham that's what it was called


[flagged]


Maybe so, but please stop posting unsubstantive comments to HN.

https://news.ycombinator.com/newsguidelines.html


Lmao who cares


Make you contact information public. Companies collect it. Surprise Pikachu :o

In the past, people used to call this crazy technology "The Phone Book".

This stuff is also on Google: "1-800" site:instagram.com


According to the article, people did not publish that information as a possible source.


Then how was it scraped? It sounds more like a security leak of some sort if it wasn't publicly accessible anywhere.


Yes, that's what the article suggests.


I suggest you to take a look at the page source on browser and you'll find out.


I'm mostly suggesting that the word "scraped" is not being used correctly. If they used an API security flaw to access all of the private data then I wouldn't consider that scraping how the term is traditionally used.


If that data is injected into the page (possibly without being visible), I would say that still counts as scraping.


Meaning they hacked Instagram? I think you are mislead by the "private contact number" phrase.


The article has theories regarding that too.


The article uses the word "scraped" multiple times. The word "hacked" is not used at all.

FB also talks about scraping:

> “Scraping data of any kind is prohibited on Instagram,” said a spokesperson.


> The scraping effort comes two years after Instagram admitted a security bug in its developer API allowed hackers to obtain the email addresses and phone numbers of six million Instagram accounts. The hackers later sold the data for bitcoin.

Obtaining data through a security bug is very much different from scraping it from public sources, and not really something you can blame on the people the data is about, as your initial comment did. So lets wait and see if the question where the data comes from gets answered clearly before blaming people for being stupid.


Semi off topic, but "influencers" are so absurd to me.

I mean, they're basically people who build a following based on being attractive, right? And the idea is that other people want to do whatever they do based on that? Seems so shallow.

Not gonna lie I follow hot people on instagram, but I definitely don't aspire to be exactly like them.


They're people who have X thousand or more followers. This gives them the power to influence their audience.

Yes, many got to where they are based on their looks. But there's also plenty of talented photographers, 3D artists, traditional artists, craftspeople, athletes, and hobbyists with large followings on IG.

Influencers are created and supported by followers like you. They don't gain that status because they're particularly skilled at anything or good marketers - they gain that status because people choose to follow them. If the majority of Insta users valued higher-quality content over shallow looks, the talented creators mentioned above would be the top influencers. It's a reflection of the user base (and on some level society as a whole).


Welcome to the world of pop culture. This is really nothing new, except maybe the scale.


The article is misleading. The data wasn't scraped because nowhere in the public profiles are emails or phone numbers visible. They were obviously obtained by hacking Instagram.


It is, actually. Sometimes it's not visible but it's available in a neat JSON format if you view page source.


I stand corrected.


viewing source of webpage is not hacking.


> nowhere in the public profiles are emails or phone numbers visible

The large majority of influencer's profiles list a business email address.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: