Mark Zuckerberg Got Hacked — Picture Yourself as the Next Victim

In January 2011, the unthinkable happened on Facebook: Mark Zuckerberg's own official fan page was compromised. Visitors briefly saw an unauthorized message posted in his name — a taunt proposing, among other things, that Facebook should become a "social business" — before the page was pulled down. Facebook attributed the incident to a bug rather than a password breach, but the details were never fully explained.

The symbolism was irresistible. If the founder of the world's largest social network couldn't keep his own page secure, what chance did the other 800 million users have?

2011 was, in fact, a rough year for the idea that anyone is safe online. High-profile breaches were becoming routine, and just weeks before this article's date, Facebook had settled with the U.S. Federal Trade Commission over charges that it had deceived users about privacy — agreeing to twenty years of independent privacy audits.

The lesson of the Zuckerberg incident isn't that security is hopeless; it's that security is a practice, not a status. The basics still matter more than anything exotic:

• Unique passwords. The most common way accounts fall isn't sophisticated hacking — it's password reuse. One breached site hands attackers the keys to everything else.
• Watch for the bug, not just the burglar. The Zuckerberg compromise reportedly came through a platform flaw, not his password. Keep software updated; flaws get patched, but only if you install the patches.
• Limit what's public. A compromised account does damage proportional to what it exposes. The less personal data sitting on a profile, the smaller the blast radius.
• Check active sessions. Facebook and most major services let you see where you're logged in. Unknown sessions are the smoke before the fire.

Zuckerberg got his page back within hours. Most victims don't have a security team on call — which is exactly why the rest of us should take the boring precautions seriously.