Lost 8 BMs and 12 ad accounts to hackers - how long to recover?

neonlights

Our entire Meta setup got compromised - 8 Business Managers, 12 ad accounts, all actively spending. Every original admin locked out. Combined monthly ad spend was well into six figures, and we're now dead in the water.

Contacted Meta support. Got the standard "under review" response. But I've heard from people who've been through this: recovery anywhere from 2 days to never. One guy had $18k drained before he could kill his cards. Meta eventually refunded it, but only after two weeks of silence and an internal escalation from someone who knew someone. Another thread said you have to harass support daily and refuse to take no for an answer - escalate to escalation, push until a human looks at it.

What I want to know:

Actual timelines from people who got fully restored - weeks? months?
Did you get back full admin access to all BMs and accounts, or did some get perma-burned?
Did Meta restore campaign history and optimisation data, or did you lose all learnings?
Any tactic that actually speeds this up? LinkedIn networking for a Meta employee hookup? Threatening legal? Or is it pure luck?

I'm furious because there's no zero-day protection. No way to prevent this other than praying. If you've been through it, drop the hard numbers - I need to know if I'm rebuilding from scratch or if there's hope.

buggedout

Happened to me as well. $18k in unauthorised spend before I killed every card. Meta didn't care.

Key timeline:

14 days of daily tickets → zero human replies from support
Only got traction after a contact inside Meta escalated it internally
Full refund eventually processed, but the process was broken

What stands out: I'd spent over £20m on that account before this happened. Still couldn't get a single support rep on the phone for two weeks. If that's the treatment at that spend level, smaller accounts must be completely invisible.

My advice: scrape LinkedIn for any second-degree connections to Meta employees. Ask colleagues at other brands if they have a rep you can borrow. The internal route is the only one that works.

Refund came through in the end, but the lack of accountability for a platform handling that much ad spend is alarming.

backlinker

Between 48 hours and indefinitely, in my experience. Meta's support is genuinely appalling. The only pattern I've seen work is consistent escalation - never accept the first automated response or the standard "we'll look into it" brush-off. Keep pushing for a tier-two human review. If you can reference specific Business Manager IDs and timestamps of the breach, that helps. I've had clients where three weeks of nothing turned into a resolution after the seventh contact. It's a lottery, but persistence is the only lever you've got.

pixelpusher

You think there are real safeguards? Meta's security is theatre.

marketingmule

Probably an email account got compromised. They need to check their inbox immediately for any suspicious Facebook-related emails. And make sure two-factor authentication is turned on everywhere - personal email, Business Manager, the lot. That's usually the first thing I see when clients come to me with multiple ad accounts hacked, the weakest link was an email with no 2FA.

neonlights

Mate, forget "will it be back" - the real question is how fast you can get it back before your pipeline bleeds out.

Blocking the cards was the right first move, but that ad account is sitting in a suspended or compromised state right now. Meta's recovery queue for hacked accounts is a black hole - anywhere from 3 days to 3 weeks, depending on how many hoops you jump through.

What actually moves the needle: submit the business verification and ID docs immediately, then open a chat support ticket. Don't rely on the help centre forms - they're garbage. If you've got a Meta rep, lean on them hard.

Pro tip: while you wait, spin up a fresh ad account on a clean BM (different payment method, different IP). Don't let your activation rate tank. A hacked account without a recovery timeline is just dead inventory.