Lil Bub, a special-needs celebrity cat, gets hacked

Lil Bub has two origin stories.

Either she’s a one-of-a-kind magical space kitty who climbed into a flying saucer to explore the dark reaches of the galaxy and subsequently wound up here on Earth, as told in a Lil Bub documentary created by Vice’s cuteness channel.

…or she’s the runt of a feral litter, found in the corner of a tool shed in Bloomington, Indiana, who was born with extreme feline dwarfism and has permanently stubby legs, a lower jaw significantly shorter than her upper jaw, and teeth that never grew in (good thing they didn’t; they’d jab her in the roof of her mouth).

The sum of all her misshapen parts – which has grown yet worse with the onset of an exceptionally rare bone condition called osteopetrosis – is that her tongue is always hanging out, her limbs stick out at odd angles, she wobbles, and she’ll will always look like a wide-eyed, surprised cat.

As you can imagine, Lil Bub has been making the internet squeal in glee for about 5 years now – amassing some 1.7 million Instagram followers in that time.

But wait. It gets more heart-melty.

You might imagine that her loving owner could make a bit of money from this adorable, sad-sack golden goose of a cat. And you’d be right. But to make Lil Bub matters even more I’m-not-crying-it’s allergy-season, owner Mike Bridavsky has donated 100% of the funds from the Lil Bub online store to an American Society for the Prevention of Cruelty to Animals (ASPCA) fund to help special needs pets.

Oh. My. GOD!!!!! How have you lived without Lil Bub this far in your life??!!!

At this point, you’re either blubbering into your keyboard or you’re tearing your hair out, wondering what in the furball-saturated, herring-scented online universe does any of this have to do with cybersecurity? Well, I’ll tell you: those 1.7 million Lil Bub Instagram addicts were rudely subjected to life without Lil Bub last week, when somebody crawled out from under a rock and hacked Lil Bub’s “I Am Lil Bub” Instagram feed.

The horror happened on 6 December, Bridavsky said on Lil Bub’s Facebook page.

According to Bridavsky, the account was hacked while he and his family were on a business trip and Lil Bub was safe at home. Mashable reports that the account’s avatar and bio were suddenly changed.

Whoever took it over – someone claiming responsibility emailed Mashable and sent screenshots that appear to show admin access to Lil Bub’s Instagram account – had control of the account for about an hour, during which they posted selfies demanding things like “if u want ur ig back call me daddy.”

Bridavsky said that a teen had taken it over. Not quite, said the person claiming responsibility:

I am not a teen, I am 11 years old.

Some reactions from Lil Bub’s sad fans:

…. I follow a cat named lil bub on Instagram and someone hacked it and I’m sad… um pic.twitter.com/Wl5kfwPcGv

— vicious (@ayyophoe) December 7, 2017

The adorable Lil Bub Instagram account got hacked and I’ve never been genuinely so upset and outraged

— Baylee (@Baylee_Shaffer) December 7, 2017

…while some pointed fingers at Instagram’s failure to protect the space kitty’s security:

Ohhh, good old @Instagram failing at keeping users safe, again! Lil Bub’s account has been hacked for ages now. Sort it out.

— Catriona (@macrae_catriona) December 7, 2017

…and others expressed a desire to see the hacker burn in the unquenchable fires of the deepest levels of Hades:

Whoever hacked Lil Bub’s instagram has a one way ticket to hell.

— ❄️Mikayla❄️ (@OneEaredWeasley) December 7, 2017

Well. Where to start in this maelstrom of emotion?

Let’s start with the notion that Instagram failed to protect the account. That’s quite a leap. It’s not that social media accounts don’t get hacked, but frequently, it’s because account holders use really bad passwords. Or they reuse passwords. That’s why many online companies pore over lists of stolen credentials: they look for stolen passwords that, when put through their hashes, match the hashes they have for their users’ passwords.

(No video? Watch on YouTube. No audio? Click on the [CC] icon for subtitles.)

That’s a good thing. It would be even better if we could convince everybody to create unique, hard-to-guess passwords and to never use them on more than one account. But given that so many people fail to do that, it’s helpful that many companies – Facebook is one – keep an eye out for user account security like that.

Now, about the “see you in Hell, you rotten 11-year-old hacker” thing: Kid, if you really are a kid, there are laws against what you did. And there are people called prosecutors and the FBI who are in charge of sending people to Hell, which is a place we also call prison.

Would they do it to an 11-year-old? Probably not. But if you keep this up, they’ll come looking for you.

So next time, before you go picking on an internet cat celebrity and emissary to special needs pets – as in, those creatures who make us feel like it’s OK to be different, that you can be as ugly and awkward as a mud pie and still be loved – think twice.