Police have arrested two Dutch teenagers who may have earned tens of thousands of euros through hacked Instagram accounts, reported nu.nl. Investigators had been building the case against the boys since November.

The boys, aged 18 and 19, sent fake emails requesting usernames and passwords to Instagram users, which appeared to come from the company itself.

After accessing the accounts, the suspects contacted advertising companies and allowed them to advertise on the accounts. They targeted accounts with tens of thousands of followers, which are valuable to advertisers.

‘These companies probably did not realize that they were dealing with hackers,’ a police spokesman told NOS. Police are currently looking into exactly how many accounts were compromised in this way.

Security flaws

With almost 400 million users, Instagram is the world’s 5^th most popular social media app. Almost 30% of internet users have an Instagram account.

However, Instagram has until now lacked a secure two-step authentication process. This means that once a hacker has a user’s email and password, they can log in and use the account at will.

Hacking has cost celebrities and companies followers and money. To combat this, the company announced last month that it will roll out a new login service. Anyone trying to log into someone’s account will need a verification code, texted to the account holder’s phone.