Instagram recovery flaw enables account takeovers; Meta identifies 20,225 affected accounts
Attackers abused Instagram recovery to obtain password-reset links for other people’s accounts. Meta identified 20,225 affected accounts, disabled the tool and secured accounts. Enable two-factor authentication and follow any official recovery checkpoint.
Turn on two-factor authentication for Instagram. If your account is affected, complete Meta’s official security checkpoint, reset your password and sign in again through verified channels. There is no device update for this incident: Meta controls the recovery service.
What’s happening
Attackers exploited an email-verification flaw in Instagram’s AI-assisted High Touch Support recovery process, which sent password-reset links to addresses unrelated to the account. Meta said this enabled access where two-factor authentication was absent, differing from early user claims that it had been bypassed. Its filing identifies 20,225 affected accounts; Meta cautioned that its affected-user count was an upper bound because some access could have been legitimate. Messages, photos, contact details, birthdays and linked services were potentially accessible, but Meta did not know what information was actually accessed. It disabled the tool, cancelled outstanding reset links and required affected accounts to pass security checks. Consumer notifications are recorded for 19 June. No later confirmation of a permanent fix or relaunch was found by 3 November.
- What
- Breach
- Affects
- Instagram account recovery (High Touch Support)
- Fixed in
- Nothing to patch
- Since
- 1 June 2026
- Closed
- 19 June 2026
Timeline
- Update
Meta’s Maine filing records electronic consumer notifications dated 19 June. It lists 20,225 people affected overall, including 30 Maine residents, and no identity-theft protection services offered.
- Update
BleepingComputer reported Meta’s disclosure of 20,225 affected accounts and potential exposure of messages, photos, contact details and connected services.
- Vendor revised
Meta told Maine’s attorney general that affected accounts had been secured. Contrary to early user claims, its explanation said attackers could log in after resetting passwords where two-factor authentication was absent; a permanent correction was planned before relaunch.
- Made public
Owners of rare and high-value Instagram accounts publicly reported hijackings and difficulty recovering access. Some claimed two-factor authentication had been enabled.
- Update
Meta discovered attackers abusing Instagram’s High Touch Support recovery system. It disabled the tool and invalidated its outstanding password-reset links that day.
- UpdateNothing to patch
Meta’s Maine breach filing lists 17 April as the incident date.
Sources
- Meta incident notification to Maine’s attorney generalMeta · 5 June 2026
- Meta Platforms, Inc. data breach filingMaine Office of the Attorney General
- Instagram users locked out after Meta AI abused to steal accountsBleepingComputer · 2 June 2026
- Over 20,000 Instagram accounts stolen in Meta AI support hackBleepingComputer · 8 June 2026