Breaches and incidentsBriefReported by a reputable outlet, citing the company
Meta: AI-assisted Instagram support tool sent password-reset links to attacker emails, 20,225 accounts hijacked
Meta’s Maine AG filing and statements: 20,225 Instagram accounts were hijacked through the AI-assisted “High Touch Support” recovery tool.
- Disclosed
What happened
- Meta’s Maine AG filing and statements: 20,225 Instagram accounts were hijacked through the AI-assisted “High Touch Support” recovery tool. Breach date in the filing: 17 Apr 2026; Meta found the bug on 31 May.
- Root cause per Meta: a bug in a separate code path failed to check that the requested email matched the account’s email, so the system sent a reset link to an unassociated address; accounts without 2FA could then be taken over.
- Attackers shared the technique in a Telegram group (TechCrunch); no named group.
- Tool and its reset links disabled; affected accounts put through a security checkpoint; similar recovery flows under review.
Sources
- https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/
- https://www.helpnetsecurity.com/2026/06/08/instagram-ai-support-vulnerability-account-takeovers/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.