What happened at Lezzet
On September 24, 2026, starting just after 6 in the morning, someone took over the Lezzet ad account.
They had my Facebook login session, stolen weeks earlier by a fake app. An invite arrived for a beta called "OpenAl Ads" (that's a lowercase L, not an i), through Apple's TestFlight. It looked official. Inside, it showed a Facebook login page. That page was fake, and logging in handed over the session.
Over that day, the attackers:
- turned on old ad sets and created scam ads for luggage straps
- raised one campaign's budget from $25 a day to $2,222 a day
- added their own authenticator as my only two-factor method, which locked me out of my own security settings
- removed my access to the ad account
Meta ads were bringing in about 85% of the website's traffic. Paid social sessions went from 128 one day to 18 the next, then zero. Web sales stopped. It took a new ad account to get going again.
Two lessons I paid for:
- One channel carrying the business is a single point of failure. When it went, everything went.
- Security setup is boring until the day it's the only thing that matters.
The accounts that matter
Every business ends up with the same handful of keys. Losing any of them can stop sales:
| Account | What losing it costs |
|---|---|
| Your email (Google Workspace) | Every password reset goes here. Lose it and you lose everything. |
| Meta Business (Facebook, Instagram, ads) | Ads, your pages, and your ad spend |
| Shopify | Your store, orders, and payouts |
| Amazon Seller Central | Your listings, inventory, and payouts |
| Your domain registrar | Your website and your email |
| Your bank | Your money |
What to watch out for
- Logging in inside an app. Never type a Facebook, Google, or Amazon password into a login page that opens inside another app. Go to the real site in your browser instead.
- "Beta invites" and "verify your account" messages. Check who the publisher is before installing anything. Phishing apps copy real names with one letter changed.
- One person, one phone, one authenticator. If your only two-factor method is on one device, or gets swapped by an attacker, you're locked out.
- Unlimited spending. An ad account with a card and no limit lets an attacker spend thousands before you wake up.
What bites you later
- A shared login. If a contractor knows your password, you can't tell who did what, and you can't remove them cleanly.
- The only admin. If you're the only admin on Meta Business and your profile is hijacked, nobody can let you back in.
- Recovery info from years ago. An old phone number or email on an account turns account recovery into a dead end.