Meta says hackers may have accessed more than 20,000 Instagram accounts through a flaw in an account recovery tool. Here’s what happened, what information was accessed, and how to protect yourself.
Table of Contents
What Happened?
High Touch Support is a support service used to help people recover access to their Instagram accounts.
Meta said attackers used the tool to send password reset links to email addresses they controlled.
Meta has informed authorities, including the Maine Attorney General’s Office, about the incident.
The company has since disabled the affected tool while it works to ensure the problem is fully fixed.
Who Was Affected and What Instagram Account Information Was Accessed?
Meta said the incident may have affected about 20,225 Instagram users.
However, the company noted that the actual number could be lower because not every account in that group was necessarily accessed by hackers.
The attack mainly affected accounts that did not have two-factor authentication (2FA) enabled. Two-factor authentication is an extra security step that requires a second code when you sign in.
Meta said it is not clear whether attackers accessed personal information stored in affected accounts.
However, the company said attackers may have been able to view:
- Profile information
- Email addresses
- Phone numbers
- Dates of birth
- Direct messages
- Social media posts
- Account activity and interaction history
This type of information can be valuable to criminals. They may use it to create convincing phishing emails, fake support messages, or impersonation attempts.
It is also worth remembering that your information may have been affected by other hacks, data breaches, or data leaks that you never heard about.
If you are not sure whether your information was leaked online, automatic monitoring can help you spot problems earlier.
Futureproof monitors your data for leaks 24/7 and helps you reduce scam risks with simple, clear steps.
How Hackers Took Over Instagram Accounts
The attack did not require stolen passwords or malware (harmful software that steals or damages information).
Instead, hackers abused a flaw in Meta’s account recovery system.
Users can normally ask the support tool to send a password reset link to the email address connected to their Instagram account.
Because of a bug (a mistake in the software), the system did not properly verify whether the requested email address actually belonged to the account owner.
Hackers entered their own email address when requesting a password reset.
The system then sent the reset link to the attacker’s email address instead of rejecting the request.
Once attackers reset the password, they could sign in to the account if two-factor authentication was not enabled.
Meta said it has invalidated the affected password reset links, reset passwords on impacted accounts, and added additional security checks.
Futureproof scans your data for leaks and shows exactly how to close security gaps — before scammers find them first.
Check my safetyWhy Your Extra Security Settings Matter More Than Ever
This incident shows that even account recovery systems can sometimes fail.
Many people focus on creating strong passwords. However, extra security settings often provide another layer of protection when something goes wrong.
In this case, Meta said accounts with two-factor authentication were much harder for attackers to access.
That is not surprising. Security experts found that adding an extra protection, such as two-step verification (2SV), two-factor authentication (2FA), or multifactor authentication (MFA), can reduce the risk of account takeovers.
If you are unsure of the differences between these terms, our guide on MFA, 2FA, and 2SV breaks it all down clearly.
The numbers show just how effective this extra layer of protection can be. Specifically, Microsoft research shows that multifactor authentication (MFA) can block more than 99.2% of account compromise attacks.
3 Simple Ways to Better Protect Your Instagram Account
These simple habits can help protect your account and personal information:
1. Add extra protection to your Instagram account
A password alone may not be enough to keep someone out of your account.
Two-factor authentication adds an extra security step after you enter your password. Even if someone steals or resets your password, they may still need a verification code to sign in.
To turn it on, open Instagram and go to Settings → Accounts Center → Password and Security → Two-Factor Authentication. Then follow the instructions on your screen.
2. Secure your email account
Your email account is connected to many of your online accounts.
If someone gains access to your email, they may be able to reset passwords for other services, including Instagram.
Use a strong password and turn on two-step verification whenever it is available.
If you are not sure how to add extra protection, the Futureproof Email Protection tool guides you through the process step by step.
Email Protection helps you create a strong password and set up two-step verification to secure your account.
3. Be cautious with unexpected security alerts
Criminals often send fake security warnings after high-profile incidents.
Be careful with emails, texts, or messages claiming your Instagram account was hacked, locked, or needs urgent attention.
Instead of clicking links in the message, open the Instagram app directly and review your security settings there. This can help you avoid phishing attempts that can steal your login information.
Protecting Your Account Takes More Than a Strong Password
Most people think hackers break into accounts by stealing passwords.
This incident shows that attackers can also take advantage of weaknesses in account recovery systems.
A strong password is still important. However, extra security features such as two-factor authentication can help stop account takeovers, even if something else goes wrong.
Taking a few minutes to review your security settings today with Futureproof Email Protection can help prevent bigger problems later.
At Futureproof, Kevin explains digital safety in simple words, with clear tips and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
