Illinois man gets six years for stealing women’s private Snapchat photos

An Illinois man has been sentenced to more than six years in federal prison for running a large-scale phishing operation that compromised the Snapchat accounts of hundreds of women and harvested private photos.

Kyle Svara, 27, of Oswego, Illinois, was sentenced to 76 months in prison, followed by three years of supervised release. He pleaded guilty in February to aggravated identity theft, wire fraud, computer fraud, conspiracy to commit computer fraud, and making false statements to investigators.

According to the US Department of Justice, Svara posed as a Snapchat representative and tricked women into surrendering the temporary security codes protecting their accounts. He then downloaded private images and sold or traded them online.

Key takeaways

• An Illinois man gets six years for stealing women's intimate Snapchat photos
• Prosecutors say he sent more than 4,500 phishing messages targeting hundreds of women
• Investigators confirmed that he accessed at least 517 Snapchat accounts
• Stolen private photos were kept, traded, sold, or supplied to people who paid for account hacks
• According to the Bitdefender 2025 Consumer Cybersecurity Survey, young people are twice as likely as their elders to fall victim to a scam
• Consumers are advised to use a trusted security solution to help identify fraudulent messages and scams

Thousands of messages sent by a fake ‘Snapchat Support Team’

Between May 2020 and February 2021, Svara collected women’s email addresses, phone numbers, and Snapchat usernames using social engineering and online resources.

He then used anonymized internet phone numbers with Los Angeles area codes to impersonate the “Snapchat Support Team.”

The phishing messages told recipients that suspicious activity had been detected in their accounts or that someone had tried to log in. Victims were instructed to reply with the access code sent to them by Snapchat, supposedly to confirm their identities or secure their accounts.

In reality, Svara had initiated the login attempt himself. The codes were the final security barrier preventing him from entering the accounts.

The government’s sentencing memorandum says he sent more than 4,500 messages to at least 1,571 unique phone numbers. Investigators ultimately associated 759 of those numbers with victims.

At least 557 women supplied the requested codes, allowing Svara into at least 517 Snapchat accounts.

From the DOJ press release:

From at least May 2020 to February 2021, Svara used social engineering and other resources to collect victim emails, phone numbers and/or Snapchat usernames. He used those means of identification to access victim Snapchat accounts, which prompted Snap Inc. to send account security codes to victims. Using anonymized phone numbers, Svara posed as a representative of Snap Inc. and texted more than 4,500 victims requesting those Snapchat access codes.

Svara’s phishing text messages (in gray)

Victims locked out of their own accounts

Once inside an account, Svara searched for compromising photos and videos.

Prosecutors say he often enabled two-factor authentication himself, effectively locking the legitimate owner out of her account. He also attempted to access “My Eyes Only,” Snapchat’s password-protected area for particularly private content.

The stolen images were not merely retained. Svara advertised account-hacking services on online forums and offered to sell or trade the material he obtained.

Investigators found spreadsheets and notes containing victims’ names, contact details, social media usernames, and comments documenting whether particular hacking attempts had succeeded.

Some records also contained personal information apparently supplied by customers to help Svara guess victims’ passwords.

University coach paid for Snapchat hacks

One of Svara’s customers was Steve Waithe, a former Northeastern University track and field coach.

According to prosecutors, Waithe paid Svara to target women he had coached or with whom he had other relationships. Svara sent more than 120 phishing messages to approximately 53 of Waithe’s known targets and received access codes from at least 27 of them.

Waithe was convicted in 2023 of wire fraud, cyberstalking, conspiracy to commit computer fraud, and computer fraud. He was sentenced to five years in prison in March 2024.

Svara also targeted women living near Plainfield, Illinois, including neighbors, friends, former classmates, family acquaintances, and friends of his wife and sister. A smaller group of students at Colby College in Maine was targeted as well.

Investigators seized Svara’s devices in July 2024. Prosecutors said police searches uncovered a substantial collection of media featuring underage subjects. Svara had earlier denied any involvement with such content when questioned by investigators.

A security code is as sensitive as your password

The campaign succeeded because victims believed they were communicating with Snapchat itself. No advanced technical exploit was needed: the attacker simply persuaded them to surrender the security mechanism keeping him out.

Verification codes are designed to prove that the person attempting to sign in controls the legitimate account holder’s phone or authentication app. Anyone requesting such a code may already have other information needed to access the account.

Neither Snapchat, a bank, an online marketplace, nor any other legitimate service will unexpectedly ask you to send a login code by text, email, phone, or direct message.

According to the Bitdefender 2025 Consumer Cybersecurity Survey, young people are twice as likely as their elders to fall victim to a scam (20% vs 9.7%). The reason? Younger generations are omni-present on social media — now the top attack avenue for scammers.

How to protect your social media accounts

• Never give a login, recovery, or verification code to another person
• Treat unexpected security messages as suspicious, even when they use familiar branding
• Open the official app directly to check for alerts instead of following instructions in a message
• Use a strong, unique password for each social media account
• Enable two-factor authentication through an authenticator app where possible
• Consider using a passkey, which is more resistant to conventional phishing
• Regularly review active sessions and remove devices or browsers you do not recognize
• Secure the email account connected to your social media profiles with its own unique password and two-factor authentication
• Use a trusted security solution to help identify fraudulent messages, malicious links, account-stealing websites and scams

If you believe your Snapchat account has been compromised, change your password immediately, confirm that the correct email address and phone number remain attached to it, and inspect the devices listed under Session Management. Snapchat provides additional instructions through its compromised-account support page.

Anyone who believes they may have been targeted in this particular campaign can also submit information through the FBI’s dedicated victim form.

Two-factor authentication remains one of the most effective ways to protect an online account, but it cannot help you if an attacker persuades you to surrender the code.

Treat any message requesting a verification code as a request for your password. If you ever find yourself in this scenario, stop, open the service through its official app or website, and verify the situation independently before taking any action.

You may also want to read:

WhatsApp usernames explained: how to reserve yours and stay safe

INTERPOL crackdown shows scammers shifting to social media

Is your social media feed the new scam inbox?