Jaya Grocer Recovers Hacked Instagram Account After Fraudulent "Anniversary Promo" Scam

Subscribe to our FREE Newsletter, or Telegram and WhatsApp channels for the latest stories and updates.

Jaya Grocer has recovered and secured its official Instagram account after it was hijacked to run a fraudulent prize promotion, the company confirmed on Wednesday evening (7 Oct).

The supermarket chain thanked customers and members of the media who helped spread the word and alert others to the scam.

The compromised account had carried posts under the label “Anniversary Promo,” falsely offering high-value prizes including gold bars and iPhones, and directing followers to an external Telegram account to claim them.

Earlier on Tuesday (6 Oct), Jaya Grocer used its verified Facebook page — the channel it turned to precisely because access to its Instagram account had been lost — to warn followers not to engage with the content and to report any financial exposure to their banks and the police immediately.

“Jaya Grocer is not running these promotions,” the company said in the notice.

Its guidance was direct: do not click any links in the posts, do not message the Telegram account, and do not make any payments.

Customers who had already interacted with the scam posts were advised to contact their bank immediately and lodge a police report.

By Wednesday evening, Jaya Grocer confirmed the account had been recovered, the fraudulent posts removed, and comments on its recovery post limited — standard practice during the containment phase of a social media security incident.

The incident follows a pattern seen across retail and food and beverage brands in Malaysia, where verified social media accounts are hijacked and repurposed to run prize scams using the brand’s credibility as cover.

Using a Telegram redirect — a channel outside the platform’s moderation — is a common feature of such schemes.

Hackers routinely target business page admins with fake Meta support alerts, sending warnings that a brand’s page is “scheduled for deletion” to force the admin into clicking a link that steals their login credentials. Once inside, the account’s verified status and existing follower base become the scam’s most valuable assets.

The Malaysian Communications and Multimedia Commission (MCMC) actively flags this tactic, noting that Facebook and Instagram are the most common vectors used by syndicates to redirect users to external chat apps or malicious links.

Jaya Grocer’s response — swift public disclosure, step-by-step guidance to affected customers, and a confirmed recovery within hours — reflects the standard recommended by Bank Negara Malaysia (BNM) and the police for social media scam incidents.

Share your thoughts with us via TRP’s Facebook, X, Instagram, or Threads.