‘Is it real?’: Two businesses destroyed after receiving eerie email message

Two business owners woke up, months apart, to find the same threatening message in their inboxes. Now both of them are in dire trouble.

A serial Russian hacker has targeted two NSW businesses, decimating their income and leaving them in dire financial straits.

Mat Paul, 43, who runs Crystal Creek Rainforest Retreat, a couples retreat in the state’s Northern Rivers region, was devastated at the end of November when he discovered his Instagram account had been hacked.

He woke up in the morning to find a chilling email waiting for him in his inbox. The hacker told him they had taken control of his account — with 38,000 followers that he had built up over 10 years — and he could only get it back if he transferred money through a WhatsApp account.

The number attached to the ransom message had a +79 mobile phone prefix indicating the hacker comes from Russia.

“When you read that it’s a bit of a panic. Is it real? Is it fake? Gradually it becomes a realisation [that it was indeed real],” Mr Paul told news.com.au.

Over the weekend, Ravi Wasan, 34, from Sydney’s west was targeted by the same hacker.

The dad-of-one runs a bird conservation not-for-profit, Feathered Friends Bird Sanctuary, the only one of its kind in NSW, with his 70,000 followers crucial for donations and attracting sponsors.

As of 11.59pm Saturday, the hacker took control of Mr Wasan’s social media business page, leaving the future of the 300 birds he cares for in doubt.

The message waiting for both men the morning after they were hacked.

The hacker, who goes by the name Farway Tyrell on Gmail, changed the Instagram handle of both accounts to a combination of “pharabenfarway” — Mr Paul’s became pharabenfarway38k2 while Mr Wasan’s was updated to pharabenfarway65k2.

After typing “pharabenfarway” into Instagram, Mr Wasan realised this was far from the first time an Aussie business had fallen prey to the hacker.

The business owners got in touch with one another after realising the same person had gone after both of their livelihoods.

Mr Paul’s Crystal Creek Rainforest Retreat account still exists but with a creepy message on its bio that reads: “This account is held to be sold back to its owner”.

For Mr Wasan, it was even worse. The account has disappeared entirely.

“People now think our business has shut down because of Covid, not because our account has been hacked,” he told news.com.au.

“In a time when we need it [Instagram] more than ever, that’s the biggest thing, to the public we don’t exist.”

To this day, both men have no idea how they lost control of their accounts. Neither recalls clicking on a dodgy link in the days before the hack.

Mat Paul’s business account with a chilling message in the bio.

Farway Tyrell has hacked dozens of other business accounts.

Like many small businesses, Mr Paul’s Crystal Creek Rainforest Retreat had struggled due to the state’s regional lockdowns and also border closures with nearby Queensland.

The summer season was meant to be when his business would make all its money back.

Mr Wasan’s business had also been heavily impacted by the pandemic, having been shut down for 106 days during Sydney’s Delta variant-prompted lockdown. About half of his visitors used to be international tourists but, of course, they haven’t been able to come for the past two years.

So the hack came at the worst possible time for both business owners.

In fact, Mr Wasan doesn’t know how his bird sanctuary can survive if he doesn’t get his Instagram account back soon.

Ravi Wasan is worried what will happen to his birds if his stream of income isn’t fixed. Picture: Sam Ruttyn

Mat Paul’s accommodation business is also feeling the sting of the hack.

“We rely on people seeing the birds on our social media,” Mr Wasan explained.

“Our sponsors come through there, our sponsors are interested in our following. When people are looking to fund us, the first thing they look at is our Instagram.

“That money pays for all our threatened birds breeding programs. We don’t receive any government funding of any kind.”

Sombrely, he added: “If we were to start again, it would destroy us. I’ve literally been crying.”

Mr Wasan cares for more than 300 birds from endangered species and says he has “huge overheads”, with it costing $2,122 a week just to feed his animals.

“The office is getting calls asking if we’ve closed down,” he added.

“It is a concern that I have if we don’t fix it [the hack] quickly.”

Ravi Wasan at the Sydney Royal Easter Show several years ago.

Ravi Wasan’s business was hacked over the weekend. Picture: Sam Ruttyn

Mat Paul’s retreat out in northern NSW has also been badly impacted.

Mr Paul and Mr Wasan are desperately petitioning Facebook, which oversees Instagram, to reinstate their accounts.

Instead of complying with the ransom, they thought it would be painless to get their social media back under control, especially with such undeniable proof that they had been hacked.

However, despite lodging multiple reports, they’ve been getting nowhere.

Two months since the hack, Mr Paul said: “Hope is dissipating that we will hear back from Instagram and we’re looking down the barrel of having to begin again from zero.

“I thought there must be a way to get it back. Gradually meeting one dead end after another on so many occasions. Any hope by the end was just lost.”

For Mr Wasan, the lack of response is an extra slap in the face considering he has given as much as $5000 per month to Facebook and Instagram to boost his content over the last eight years.

“Other people have waited six weeks [for Facebook to fix it], our business won’t survive six weeks,” he said.

Mr Paul said losing his social media would impact his revenue long-term.

Ravi Wasan is calling for Facebook to do more. Picture: Sam Ruttyn

News.com.au flagged the issue with Facebook and a spokesperson confirmed an investigation is now underway into both accounts.

Facebook said it was crucial to stay vigilant against hackers.

“It’s important people understand how to protect their accounts from suspicious activity which is why we’ve built features that give people the power to manage their experience with our platforms and take action when they see something suspicious,” it said in a statement.

Steps involve turning on two-factor authentication, reporting suspicious accounts, and avoiding phishing such as not clicking on dodgy links or responding to strange messages and emails.

Has this happened to you? Continue the conversation | [e-mail]