Meta Says Attackers Hijacked More Than 20,000 Instagram Accounts Through Recovery Flaw

Summary

Meta says attackers abused its AI-assisted High Touch Support recovery tool to hijack more than 20,000 Instagram accounts. The company disabled the tool, secured affected accounts and plans to fix email verification before relaunching it.

Key points

Attackers exploited Meta’s High Touch Support recovery tool to obtain password-reset links and hijack Instagram accounts.
The tool failed to verify that submitted email addresses were associated with the targeted accounts; accounts without two-factor authentication were especially vulnerable.
Meta disclosed more than 20,000 affected users; a breach letter separately said 30 users in Maine’s jurisdiction were potentially affected.
Meta said it discovered the vulnerability on May 31, 2026. A Maine filing lists April 17 as the breach date, which the article says is likely the first attack date.
Meta disabled the tool, revoked generated reset links, secured affected accounts and required users to reset passwords and re-authenticate.
Meta said it had no information on what personal information may have been accessed or stolen, but listed account and contact information, posts, messages and activity as potentially accessible.
Meta plans to fix email verification before relaunching the tool and is reviewing similar account-recovery flows.

Article Details

Victim Organization: Meta
Victim Domain: instagram.com
Incident Type: Account takeover through abuse of a vulnerability in Instagram's AI-assisted High Touch Support (HTS) account-recovery system, which allowed password reset links to be obtained without verifying the email address associated with an account.
Incident Date: 2026-04-17
Data Types Exposed: Potentially accessible: email addresses and/or phone numbers
Potentially accessible: dates of birth
Potentially accessible: social media posts and content, including photos, videos, and stories
Potentially accessible: direct messages and communications
Potentially accessible: account activity and interaction history
Potentially accessible: profile information, including biographies and profile photos
Potentially accessible: information associated with other connected accounts and linked services
Affected Records: More than 20,000 Instagram accounts were reported hijacked. Meta separately said accounts of 30 users in Maine's jurisdiction were potentially compromised.
Operational Impact: Attackers used the recovery flaw to obtain password reset links and hijack accounts. Meta disabled HTS, revoked the reset links it had generated, secured affected accounts, required security checkpoints and password resets with re-authentication, and said it would fix email verification and review similar recovery flows. Accounts without two-factor authentication were especially vulnerable.
Ransom Or Extortion: None reported.
Claim Status: confirmed