![\"Meta\"](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/06\/Meta.jpg\")
<\/p>\n<\/p>\n
Meta has revealed that 20,225 Instagram users had their accounts hijacked in a recent incident where attackers\u00a0used Meta’s AI-powered support system to reset passwords.<\/p>\n
As BleepingComputer reported one week ago, the threat actors exploited a flaw in the company’s High Touch Support (HTS) tool<\/a>,\u00a0an AI-assisted support system that\u00a0helps users regain access after being\u00a0locked out of their Instagram\u00a0accounts.<\/p>\n By exploiting the fact that HTS didn’t verify whether email addresses were associated with the targeted Instagram accounts, they obtained password reset links that allowed them to log in and hijack accounts without\u00a0two-factor authentication (2FA) enabled.<\/p>\n “Users can request support from HTS and, as part of that process, can ask that a password reset link be sent to their email address. The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user\u2019s Instagram account,”\u00a0said<\/a> Amber Hannah, Meta\u2019s associate general counsel for incident response legal, in a data breach letter\u00a0recently\u00a0filed with Maine’s Office of the Attorney General.<\/p>\n “As a result, when an individual provided an email address not previously associated with the account, the system incorrectly sent a password reset link to that unassociated email rather than rejecting the request. This allowed unauthorized third parties to receive a password reset link for accounts they did not own. Upon resetting the password, the unauthorized party was able to log in to the account if the account holder had not enabled two-factor authentication (2FA).”<\/p>\n After a wave of user reports regarding these attacks hit social media platforms,\u00a0Andy Stone, Meta’s\u00a0vice president of communications,\u00a0replied<\/a>\u00a0to one of the affected users, stating that the “issue has been resolved, and we are securing impacted accounts.”<\/p>\n BleepingComputer has also contacted Meta last week for comment on this security breach, but we have yet to hear back.<\/p>\n “We are writing to inform you that a vulnerability in an Instagram account recovery support tool\u00a0was used to potentially compromise the Instagram accounts of 30 users in your jurisdiction. All\u00a0accounts have been secured to prevent any continued unauthorized access,” Hannah\u00a0added. “On May 31, 2026, Meta discovered that there was a vulnerability in an AI-assisted account\u00a0recovery system for Instagram (‘High Touch Support’\u00a0or ‘HTS’) that was exploited by\u00a0unauthorized third parties to perform password resets on Instagram user accounts.”<\/p>\n While Meta didn’t specify when the attacks began in the breach letter, the filing on Maine’s OAG website says the breach occurred on April 17, which is likely the date of the first attack exploiting the HTS flaw.<\/p>\n The company says it has no information on what personal information might have been accessed or stolen from the compromised accounts, but\u00a0noted\u00a0that the attackers could’ve gained access to affected Instagram users’ contact information (email address and\/or phone number), dates of birth, social media posts and content (photos, videos, stories), direct messages and communications, account activity and interaction history, profile information (biography, profile photo), as well as other connected accounts and linked services.<\/p>\n After discovering the incident, the company disabled the\u00a0HTS AI-powered support system and all password reset links it had generated to ensure that all future hijack attempts part of the same malicious campaign would be blocked.<\/p>\n It also enrolled all potentially stolen accounts into a mandatory security checkpoint and asked all affected users to reset their passwords again and re-authenticate to secure and regain control\u00a0of the\u00a0compromised\u00a0accounts.\u00a0<\/p>\n “Prior to re-launching the tool, Meta will fix the authentication check in the Instagram recovery\u00a0entry point to ensure proper verification of email addresses against existing account information\u00a0before any password reset is initiated,” Meta added.\u00a0“Additionally, Meta is conducting a comprehensive review of similar account recovery flows across Meta\u2019s platforms to identify and remediate any potential issues.”<\/p>\n Prior\u00a0to this incident,\u00a0Ireland also fined Meta $264 million<\/a> over a 2018 data breach<\/a> that exposed the names, email addresses, phone numbers, and physical locations of over 29 million\u00a0Facebook accounts.<\/p>\n Meta was also\u00a0fined \u20ac265 million ($275.5 million) in November 2022 for failing to protect Facebook users’ data from scrapers<\/a>,\u00a0and another\u00a0\u20ac91 million ($100 million)\u00a0for storing the passwords of hundreds of millions of users\u00a0in plaintext<\/a>.<\/p>\n![\"image\"](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/06\/state-of-ai-report-970.jpg\")
<\/a><\/p>\n![\"Chat](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/06\/chat.jpg\")
Chat with the Meta’s AI support HTS agent (@thecomfeed)<\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/06\/bas-report.jpg\")
<\/a><\/p>\n