The terror campaign over coveted Instagram handles

On a balmy Thursday in March 2020, just before the coronavirus...
Read on Insider.com
INSIDER
Subscribe

INSIDER FEATURED ARTICLE

Insider Featured Article

TECH

'I want your Instagram account': First came the threatening texts, followed by the SWAT teams. Then someone wound up dead.

By Rob Price

On a balmy Thursday in March 2020, just before the coronavirus pandemic upended the world, a 911 call came into the Palo Alto Police Department. The caller told the dispatcher he had killed his girlfriend. He had barricaded himself inside his home in a quiet, affluent neighborhood on the eastern edge of Palo Alto. Before hanging up, he threatened to shoot any officers who got too close to the house.

The police quickly traced the 415 number and determined that it belonged to Chris Eberle, a midlevel Netflix executive. When calls to the number went unanswered, the police descended in force. Armed officers surrounded the midcentury bungalow on Moreno Avenue, a sleepy side street. A nearby elementary school was ordered into lockdown. Kids were rushed in from recess and bolted in their classrooms, window blinds drawn.

But when officers stormed the house, they found only a terrified — and bewildered — family of four inside. Eberle, it turned out, was the former tenant. He had moved out seven years ago. The puzzled officers apologized to the rattled family and headed back to the station house in downtown Palo Alto.

A short while later, a tall, ruddy man with a shock of red hair and a beard to match walked into the police station. His name was Chris Eberle, he told the officer on desk duty. He thought he knew what was going on.

It was all because of his Instagram account.

The night before, Eberle had been settling in for bed with his wife when his phone pinged with a text from an unknown number.

"Hey Christopher. Gonna need @ginger on Instagram," the message said. "Harassment to you and family will start now."

Eberle laughed. The threatening text wasn't the first time he had been contacted about @ginger. He had nabbed the username on Instagram and Twitter not long after each platform launched. It was a semi-ironic nod to what had once been a target of childhood teasing: his red hair. A hardcore punk-rock kid who had grown into a seasoned tech executive, Eberle understood the power of social media. Now in his late 40s, he had worked everywhere from tech giants like AOL and Facebook to the crypto startup Swarm. In 2019, he had taken a job as a marketing director at Netflix.

But in the years since he had registered @ginger, novel usernames had become increasingly coveted on social media, a sign of early-adopter cool. Countless people had offered to buy the handle from Eberle, and he suspected that the late-night message might be a prank by a friend.

"Lol," he texted back.

The immediate response: "Haha okay."

Half an hour later, the calls began. First there was the tow-truck driver, phoning to say he was outside and asking which vehicle needed towing. Then came a call about a pizza order that Eberle had never placed. He peered out the window, but there was no one there. The delivery guy had been directed to his old address on Moreno Avenue, about 2 miles away. The promised "harassment" had begun. Eberle shrugged, put his phone on do-not-disturb mode, and went to bed.

But while Eberle slept, the anonymous texter was busy. When Eberle woke up the next morning, his phone was deluged with messages and voicemails from confused and frustrated delivery people looking for his address. Eberle was unsettled — the harassment was no less menacing for its banality — but he had to go to work. He got in his red Tesla and drove the 19 miles to Netflix's offices in Los Gatos.

Throughout the morning, the confirmation emails and delivery calls kept coming. And the orders weren't just going to Palo Alto. They were also going to Chicago and New York, where his sister and his recently widowed mother lived. Delivery drivers were deluging his baffled mom with calls, telling her they had a pizza that Chris Eberle ordered for her. The texter wasn't just targeting him, Eberle realized, feeling his anxiety turn to anger. They're going after my family.

That afternoon, during a meeting at Netflix in a fish-bowl conference room, an urgent call from Eberle's wife overrode his phone's do-not-disturb mode. Their son's elementary school had been placed in lockdown because of unspecified "police activity" in the neighborhood. When he hung up, Eberle noticed his phone showed missed calls from the Palo Alto Police Department.

A creeping fear set in. The tow truck, the pizzas, the police calls, the fact his old house was only a stone's throw from the school. It looked like a case of "swatting," a powerful, vicious weapon that internet pranksters have used for years. Swatters place hoax calls to local police departments, provoking heavily armed SWAT teams to storm the homes of their victims. Haters have swatted online influencers, streamers on Twitch, and prominent figures in the tech industry, including Facebook executives and the head of Instagram, Adam Mosseri. In 2017, the police in Wichita, Kansas, fatally shot a man after they were summoned by a swatting attack over an online match of "Call of Duty."

Now, it appeared that someone — presumably the texter from the previous night — had spoofed Eberle's phone number and was using it to swat him over his refusal to surrender @ginger. The texter was going to war over an Instagram handle.

Eberle left work and drove to the Palo Alto police station, where he explained the situation. But there wasn't much the police could do about it. Eberle didn't yet realize that the tsunami of calls about pizzas would prove to be just the opening salvo in a protracted nightmare for him and his family — a years-long saga that underscores how easily public information can be weaponized by bad actors in the internet era, and how something as seemingly trivial as a username can destroy a person's life.

Why would someone care so much about a social-media handle?

especially Instagram, has created a robust underground market for "OG handles" — unique usernames that convey "original gangster" cred. Instagram, Twitter, TikTok, and other major platforms ban the sale of usernames, so online marketplaces like OG Users and Swapd have sprung up, enabling sellers to advertise their wares complete with Amazon-style reviews of their trustworthiness and service. The most valuable Instagram usernames — two-letter handles, as well as memorable words like ginger — can sell for thousands of dollars. The rarer the handle, the more powerful the lust to own it.

Sellers go to extreme and often ingenious lengths to get their hands on coveted handles. Some have written automated scripts to monitor accounts with desirable usernames on Instagram and other platforms, and then pounce on any handles that wind up being abandoned by their users. Others have taken to scouring leaked emails and passwords from data breaches on other sites. If they find an inactive email address and password linked to a dormant Instagram account, they simply re-register it and send a password reset, which goes to the email inbox they now control.

If the sought-after account is still active, it can be trickier. A trader might try to persuade the owner to sell the handle to them — hopefully at a fraction of its true value — and then flip it online for a profit. If the owner won't sell, the trader might try to steal it, bombarding the owner with phony password resets or account recovery requests. And if all else fails, there's always the nuclear option: Harass the owner until they surrender the handle.

Insider Featured Article

The attack on Chris Eberle went on for two days. Then, without warning, the barrage of orders and deliveries abruptly stopped. Eberle and his wife, feeling strangely guilty about the swatting, emailed other parents at their son's school to apologize for the active-shooter lockdown. "We're sorry that this is happening, and that it has now impacted all of you," they wrote. The police advised Eberle to forget about the harassment — it looked as if the attacker had grown bored and moved on. As the weeks passed, the episode started to feel like a strange and fading dream.

Then one night, a month later, the doorbell rang. It was after midnight, and the family was asleep. When Eberle went to the front door, he was greeted by a Papa John's delivery person with an order for him. Eberle mumbled his way through an apology, his heart pounding in his chest: His assailant had figured out where he lived.

A new deluge began, this time to his current address. Japanese, Mexican, Chinese — seemingly every takeout option on the San Francisco Peninsula was suddenly winging its way to Eberle's home. His sister in Brooklyn, New York, was also hit with cash-on-delivery orders, along with his adult daughter at graduate school in San Diego and his in-laws in Connecticut.

Eberle was shaken. His son's school had been locked down, his harasser showed no signs of stopping, and he still had no idea who was behind it. In desperation, he told a former colleague from Facebook what he was going through.

"Dude, you need to talk to Ana," she told him, referring to another ex-colleague from Facebook. "The same shit's happening to her."

Ana, a tech executive in the Bay Area, was the proud owner of a two-letter Instagram handle corresponding to her initials. (Insider has changed the names of some victims at their request.) She had given birth early in the pandemic and was recovering in a locked-down San Francisco hospital room when she got her first call about Thai food. Pizza orders had swiftly followed, she explained to Eberle after he reached out, and her brother and cousin were also targeted.

She didn't understand what was going on until a week later. In the early hours of the morning, caring for her newborn, she got a call from an unknown number. On the other end of the line a stranger rasped at her, his tone artificially distorted: "I want your Instagram account."

And there was more, she told Eberle. Across Silicon Valley and beyond, a wave of tech-industry veterans with distinctive usernames were being similarly tormented. There was a sickeningly familiar pattern to the attacks, which had begun in January 2020. Some victims were targeted with menacing phone calls and messages; many received unsolicited food orders to their homes and the homes of their family members. An unlucky few were swatted.

Josh Williams was having a particularly rough time of it. A veteran designer whose résumé included jobs at Facebook and Squarespace, he had scored his @jw handle not long after Twitter launched at South by Southwest in 2006. One evening in early April, while Williams was preparing to spend a quiet night at home working on a jigsaw puzzle with his family, his daughter got a text from a friend alerting her to a commotion in the front yard. Stepping outside, Williams was dazzled by police floodlights. The house was surrounded by dozens of armed officers, and police dogs strained at their leashes. He was being swatted.

The cops had been told that Williams had murdered his wife, locked his kids in the bathroom, and soaked the house in gasoline. His wife later found a warning in her Instagram inbox: "if you don't convince your husband to give me his username, @jw I am going to continue to harass you, your husband, and your kids."

Insider Featured Article

One by one, through word of mouth, Williams and Ana and other victims of the handle harassment found one another. They didn't know who was behind the assaults, and they didn't know how to stop them. But like soldiers drafted into a war beyond their making, they shared a bond. They decided to form an informal network to support one another. They called it "Handle Heroes."

It was, Eberle quickly learned, part group therapy session and part intelligence-gathering operation. The half-dozen Heroes communicated via Facebook Messenger, discussing who had been hit most recently, looking for commonalities in the attacks, and trying to figure out who was behind it. They shared advice on how to dodge SIM-swapping, a technique hackers use to steal phone numbers. They traded theories on whether their assailant might be harvesting voter-registration info to track them down. They called people they knew at Facebook, which owns Instagram, in an effort to sidestep its notoriously unresponsive customer-service system.

"It felt comforting in a terrifying experience," says one Hero, who asked to remain anonymous. "Like if we were all hostages on a plane, you know — we're all going through it together."

But being in the group also exacerbated their fears. For those like Ana who hadn't been heavily targeted, every swatting of a Hero was an example of how much worse things could get. A pizza wasn't just a pizza; it was a reminder that the assailant knew where you lived, and any moment a hoodwinked SWAT team wielding assault rifles could break down your front door.

To make matters worse, the Heroes found themselves facing skepticism from friends, family members, and authorities. When Ana had tried to explain to the police what was happening to her, she was laughed off the phone. When Josh Williams was swatted, an inquisitive neighbor with a police scanner posted on Facebook that there was a "suspect with a firearm" on the street who had "possibly murdered his wife." The father of one of his daughter's friends later told him matter-of-factly: "If that had really happened — no offense, but I was going to kill you."

In mid-April, a Hero named Oscar got a call with a warning. Give up your handle, the voice said, "or the pain continues." Ten days later, Oscar's ex-partner got in touch with him. Armed police officers had stormed the home where she and their daughter were staying. The police had received a call from someone claiming to be Oscar, who had confessed to killing his wife and was threatening to slaughter everyone else in the house. But when Oscar later explained what had happened to his former partner's parents, they didn't believe him. Why would cops search their house over a tussle involving a social-media account? There must be more to it. Did Oscar secretly owe someone money?

And then there was the day-to-day hassle of dealing with all the false deliveries. Again and again, over and over, for days and weeks on end, the Heroes had to explain to frustrated drivers that, no, sorry, they hadn't ordered any food and couldn't pay them — an especially painful thing for restaurants already struggling to survive the pandemic. Eberle resorted to taping a piece of paper over his doorbell and putting a sign outside his front door: "A scammer is placing bogus orders and has scammed you. Sorry, but we did not order anything. Please do not disturb."

In an effort to thwart the endless calls about deliveries, Eberle also ditched his old cellphone number. But that caused an unexpected problem: His new number, he discovered, had previously belonged to a sex worker who specialized in catering to unconventional tastes. "Interested in golden shower brown shower incall where are you located," one would-be customer texted Eberle. He had to block dozens of incoming calls before the new number was finally usable.

As the weeks dragged on, the Heroes kept looking for clues as to who was targeting them, and how their assailant had acquired their information. Then, in the last week of April, one of them found the lists.

On "Doxbin," a shadowy message board dedicated to publishing people's private data, users compile, trade, and sell vast lists of contact details for the owners of valuable social-media handles. One list was called, in part, "Extorting Squad." Another list, found on a different message board, contained the email addresses associated with almost every one of the 1,400-plus possible two-letter and two-number Instagram handles, from @00 to @zz. The lists included contact info for some of the Heroes, which raised a chilling possibility: Even if the Heroes managed to stop their unknown tormenter, someone else could easily launch a new assault, at any time.

Fed up with the lack of response from local police departments, the Heroes had already reached out to the FBI. After Josh Williams was swatted, he was put in touch with an FBI special agent named Shannon Hickman, who was based not far from his home in Napa Valley. Hickman, who exudes an aura of calm professionalism, became a kind of impromptu counselor to many of the Heroes, taking their agitated calls at all hours of the day and night and collecting their crowdsourced intel.

In early May, not long after the Heroes found the "extorting" lists, Hickman emailed the group with good news. Law enforcement, she told them, had made an arrest "in connection to this case." But, she cautioned, "there may still be others out there continuing to participate in this behavior."

A few weeks later, Hickman told Ana the name of the suspect: Shane Sonderman.

More than 400 miles north of the Bay Area, where most of the Handle Heroes lived, an Oregon woman was going through hell.

Beginning in December 2019, she had been barraged with calls, messages, and unwanted takeout orders from someone who coveted her Instagram handle. Her mother, who lived in Ohio, was also being harassed.

But for the federal agents who were investigating, the woman's case had yielded a useful piece of information: a phone number linked to Sonderman, a teenager in Tennessee who had just turned 18. As evidence of similar attacks came filtering in from across the country, a federal prosecutor in Memphis named Debra Ireland got to work building a case against Sonderman.

Sonderman, according to court filings, was part of a loose group prepared to do whatever it took to get their hands on OG handles. He lived in Ripley, a quiet Tennessee town of 8,000, where he had a "turbulent childhood" and a family history of "severe mental illness." His group, which coordinated on the chat app Discord, used online databases of contact information to launch waves of harassment against their targets. They sent threatening messages, ordered mountains of pizza, and called child protective services with phony complaints — all to intimidate their victims into surrendering their usernames. Investigators obtained Discord logs in which Sonderman bragged about selling handles for thousands of dollars.

Then, in late April 2020, things turned deadly. One of Sonderman's targets, prosecutors say, was a computer programmer named Mark Herring, who owned the @Tennessee handle on Twitter. On April 27, according to court filings, one of Sonderman's coconspirators called the police and told them that Herring had murdered a woman and boobytrapped his home in the tiny Tennessee town of Bethpage with pipe bombs. A SWAT team descended on Herring's home and confronted the 60-year-old grandfather on his porch. After being ordered to approach with his hands raised, Herring suffered a heart attack, collapsed, and died.

A few days later, Sonderman was arrested at home by US marshals.

Insider Featured Article

The Handle Heroes felt relieved. They tried to move on, but it wasn't easy. The ordeal had left some of them fearful and jumpy: An unexpected knock at the door, or a call from an unknown number, could trigger a rush of panicked adrenaline. The internet was once their playground; their coveted handles had been a mark of pride. Now their usernames felt like having a target on their back.

Still, the harassment came to an end. The pizzas stopped coming. Life went on. Chris Eberle and his family bought a new house and moved.

Until one day in March 2021, a year after it all began, when Eberle once again started getting bombarded by calls from restaurants.

Someone had found his new phone number, and they were placing a rash of new takeout orders — albeit to his old address. Over several days, they assailed Eberle, his mother, his in-laws, and his adult daughter with more than 20 unsolicited food orders. The restaurants were also getting frustrated. "This is not cool, man," an exasperated owner told Eberle. "You're costing me over $100. You need to cut this shit out."

If there was any doubt about the reason for the new assault, a text that Eberle received on the second evening cleared it up. "You want to give the instagram and twitter now?" the texter asked. "It's not gonna stop."

Eberle messaged the other Handle Heroes, but none of them were being targeted again. Hickman, the FBI agent, told him she suspected it was a new harasser with access to the extortion lists. Or it could be one of Shane Sonderman's unindicted partners in crime. Whoever was behind the attack, it soon stopped as abruptly as it had begun.

There was one other possible suspect in the renewed attack: Sonderman himself. At the time, while his lawyers were hashing out a plea deal with prosecutors over the case that led to the death of Mark Herring, Sonderman had been out on bail. He finally pleaded guilty in the case in March 2021 — a week after the new assault on Eberle began. Shortly afterward, flabbergasted prosecutors discovered that Sonderman had continued harassing some OG handle owners while he was out on bail — meaning it's possible he was behind the second assault on Eberle.

In April 2021, Sonderman was taken back into custody. Two months later, he was sentenced to five years in prison for conspiracy. He is serving his time at FCI Texarkana, a low-security correctional institution on the Texas border. He and his lawyers did not respond to requests for comment.

Herring's death wasn't made public until Sonderman's sentencing, and the Handle Heroes were horrified by the news. But it also represented a kind of closure. While their cases weren't cited in the court filings related to Sonderman's charges, Hickman went out of her way to tell Ana about Sonderman, and his modus operandi was identical to what the Heroes had experienced.

Ireland, who prosecuted Sonderman, says she is unable to definitively tie him to the nightmare the Heroes experienced. Court filings mention two unnamed coconspirators, one of whom was a minor in the United Kingdom. "The group that does this — it's not a firm group," Ireland explains. "It's a fluid group. Sometimes it's who happens to be available when someone wants to do something. Sometimes it's a trusted pair of people who work together regularly, but they'll work with other people too. What we can say is there's an overall scheme and pattern that likely has some participants in common."

In other words: Some of the people involved in harassing the Heroes could still be out there.

The campaign of handle harassment transformed how many of the Heroes think about their relationship to internet fame. "I used to be very proud of having these usernames and being known by my name," one victim says. "I would go to these big events and people would know me by name and they would recognize me. Now I want the exact opposite."

Some of the Heroes have taken to trawling online directories to remove their personal info and contact information, and they self-censor what they post about themselves and their families. While they recognize that there are limits to what Facebook and Twitter can do to limit off-platform harassment, they're deeply frustrated by the failure of the major platforms to provide meaningful support to people who are targets of abuse. (A representative for Facebook said the company worked with the Justice Department on the Sonderman case and was engaged in a protracted battle of cat and mouse with handle sellers, disabling stolen accounts and threatening offenders with legal action.)

Despite their lingering trauma, however, most of the Handle Heroes have held onto their OG usernames. "There's a little bit of like, 'I'm not going to let the terrorists win' sort of mentality," says Josh Williams. But after the second round of harassment he faced, Chris Eberle decided enough was enough. He reached out to a mental-health startup called Ginger and struck an arrangement for it to take the @ginger handle off his hands. That, he hoped, would finally be the end of it. He left Netflix to dive back into cryptocurrencies and Web3, and he registered as @DeFiGinger on Instagram and Twitter.

But one cool Friday evening in late April, more than two years after it all began, Eberle saw a text from his mother light up his phone.

"Just declined a large Domino's delivery," she wrote. "I hate to ask, but do you know anything about it?"

Suggested reads

Click here to read this article on-site.

Read the stories that matter most to you from wherever you are with the Insider App. Download the app today!
Powered By SailthrU

Key phrases

Older messages

An American Airlines pilot says making passengers get off a plane after boarding is 'so embarrassing' and he 'absolutely hates' it

Monday, July 18, 2022

A pilot who has flown for American for 23 years says the airline's crew scheduling policies mean that trips are now 'like a game of whack-a-mole'. View in browser Business Insider Business

Wall Street: Eyes on Goldman as banks miss earnings

Monday, July 18, 2022

The latest in finance. View in browser INSIDER INSIDER Subscribe 10 THINGS ON WALL STREET Happy earnings Monday! It's Aaron Weinman here. Citi stood tall, but peers like JPMorgan, Bank of America,

Inflation has stopped Americans from buying vehicles of all kinds — but they're still splurging on travel and good times

Saturday, July 16, 2022

Despite US inflation at a 41-year high, people are still spending on travel-related expenses like flights and hotels. View in browser Business Insider Business Insider Business Insider Subscribe

8 ways entrepreneurs can earn passive income and increase their earnings

Friday, July 15, 2022

Founders who focus on generating passive income can have greater flexibility to focus on their business ventures. View in browser Business Insider Business Insider Business Insider Subscribe Business

Wall Street: BlackRock scales down hiring

Friday, July 15, 2022

The latest in finance. View in browser INSIDER INSIDER Subscribe 10 THINGS ON WALL STREET Hi, Aaron Weinman here. It was quite the Thursday with JPMorgan Chase and Morgan Stanley's earnings both

You Might Also Like

Cashless Chronicles? - Issue #461

Friday, March 29, 2024

The digital finance era unfolds, charting new paths for global economies. March 29, 2024 FinTech Weekly presents a panorama where each thread weaves into the broader narrative of digital finance's

🤝 Amazon doubled down on AI

Thursday, March 28, 2024

China's green energy goodies are too cheap for the US | Amazon doubled down on Anthropic | Finimize TOGETHER WITH Hi Reader, here's what you need to know for March 29th in 3:12 minutes. 🌞 As

🤝 Amazon doubled down on AI

Thursday, March 28, 2024

China's green energy goodies are too cheap for the US | Amazon doubled down on Anthropic | Finimize TOGETHER WITH Hi Reader, here's what you need to know for March 29th in 3:12 minutes. 🌞 As

China’s ‘lost decade’

Thursday, March 28, 2024

Bloomberg Evening Briefing View in browser Bloomberg Ray Dalio has a warning for China. The hedge fund titan says the country should cut its debt and ease monetary policy or face “a lost decade.” China

Looking to buy a home? Good news.

Thursday, March 28, 2024

Don't miss out on lower mortgage rates ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌ ͏‌

This woman made investing history

Thursday, March 28, 2024

And so can you. ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌

The Simple Solution Worth Billions to Walmart and Amazon

Thursday, March 28, 2024

The following is a third-party sponsored message. It should not be considered a recommendation or endorsement by HS Dent Publishing. Dear Investor, In warfighting, there's a saying: "Amateurs

Markup matters: monetary policy works through aspirations

Thursday, March 28, 2024

Tim Willems and Rick van der Ploeg Since the post-Covid rise in inflation has been accompanied by strong wage growth, interactions between wage and price-setters, each wishing to attain a certain

🇯🇵 Japan's latest low

Wednesday, March 27, 2024

Visa and Mastercard cut merchants some slack | Japan's yen hit a 30-year low against the US dollar | Finimize TOGETHER WITH Hi Reader, here's what you need to know for March 28th in 3:14

‘Out of the blue’ correction

Wednesday, March 27, 2024

Bloomberg Evening Briefing View in browser Bloomberg With a number of market watchers warning of a bubble, traders are increasingly on the lookout for signs of the cliff's edge. But if you ask