Meta AI Instagram recovery bug exposed 20,225 accounts

Meta has disclosed that a vulnerability in an AI-powered account recovery tool for Instagram allowed hackers to compromise more than 20,000 user accounts over a period of nearly seven weeks. The company filed a data breach notice with the Maine Attorney General's office stating that 20,225 accounts were affected, including 30 belonging to Maine residents.

According to the filing, the flaw existed in an AI-assisted support tool called "High Touch Support," designed to help users regain access to locked accounts. The system allowed anyone to request a password reset link for an Instagram account and have it sent to any email address they provided, without verifying that the email belonged to the account owner. This enabled unauthorized individuals to reset passwords and gain access, provided the targeted account did not have two-factor authentication enabled.

The exploitation began around April 17 and was discovered by Meta on May 31. The company said it disabled the vulnerable tool on the same day it was identified, invalidated all password reset links generated through the flawed process, and placed affected accounts behind a mandatory security checkpoint requiring password...