Receiving a hostile comment is a common experience. Receiving hundreds in a few hours, from accounts you do not know, all with similar tones and accusations, is something else. In these cases it is not individuals who have each decided to criticise you: it is often an organised action, in which a small group starts things off and others follow. Understanding what is happening is the first step to not being overwhelmed.
Spontaneous or coordinated?
A spontaneous controversy can be fierce, but it tends to unfold in a disorderly way: different opinions, different tones, real people with recognisable profiles. A coordinated campaign shows recurring signs instead:
- synchrony: many messages arrive within the same short time window;
- repetition: almost identical phrases, hashtags or accusations repeated by different accounts;
- suspicious accounts: recently created profiles, with no photo or generic photos, little content or activity focused solely on you;
- an identifiable starting point: a post, video or group message that explicitly or implicitly invites people to attack you;
- spread across platforms: within the same days, attacks appear on social media, in reviews and by email.
Not all of them need to be present. Two or three of these signs together already make orchestration likely.
The first hours: protect yourself
Reduce the attack surface
Many platforms let you temporarily limit who can comment, mention you or message you privately. Turn these options on: it is not surrender, it is a protective measure. You can also temporarily make your personal profile private if you do not need it for work.
Do not reply one by one
Replying to each attack feeds the campaign: every reply generates new reactions, increases the visibility of the content and gives the attackers the feeling they are getting what they want. Silence is better, or a single public statement.
Get help reading the messages
Reading hundreds of insults has a real emotional cost. If possible, ask someone you trust to go through the messages, flag the most serious ones and document them. That way you can stay clear-headed for the important decisions.
Document the whole picture
In a campaign, the individual message matters less than the overall picture. Gather:
- the content that started the attack, with its address and a screenshot;
- a significant sample of the messages, with authors and times;
- a list of the most active accounts;
- proof of repetition, meaning identical or near-identical messages from different accounts;
- any threats, published personal data or calls for real-world action, to be handled as a priority.
A simple table with date, time, platform, account and content makes coordination far more evident than a hundred scattered screenshots.
Flagging effectively
Platforms have specific rules against coordinated inauthentic behaviour, as well as against harassment. When you flag:
- flag the original content, which is often the most important to remove;
- flag the most aggressive accounts individually;
- if the platform offers a channel for mass harassment or coordinated behaviour, use it, describing the episode as a whole;
- point out the repetition: "The same three messages were posted by more than fifty different accounts within two hours".
If the attack spreads to your business reviews, many review platforms can temporarily suspend new reviews: ask for it explicitly.
When limits are crossed
Some elements turn a campaign into a problem to deal with outside the platform too:
- threats to your safety or that of your family;
- publication of your address, workplace or other personal data;
- false accusations of crimes;
- direct contact with your employer, clients or family.
In these cases it is wise to go to the police or a lawyer, bringing the documentation you have gathered. Threats should be reported immediately, without waiting for the campaign to die down.
After the storm
Coordinated campaigns usually burn out within days or weeks, when attention moves elsewhere. But traces remain: comments, reviews and posts that keep appearing in searches for your name. In the following months, check the results, flag what is left and, if needed, consider removal or delisting requests for the most serious content.
In short
- Synchrony, repetition and suspicious accounts are the typical signs of an organised attack.
- Temporarily limit comments and messages and do not reply to attacks one by one.
- Document the overall picture, starting from the content that triggered the attack.
- Flag both individual accounts and the episode as a whole, highlighting the coordination.
- Threats and the publication of personal data should be taken to the authorities immediately.