Disclosed Jan 11, 20268 months ago20,225 affectedUnverified
Attackers tricked Meta AI support assistant into hijacking 20,225 Instagram accounts
Hackers asked Meta's AI-powered support assistant to add attacker email addresses to Instagram accounts and send reset links, taking over accounts without 2FA. Meta said a bug in a separate code path failed to check the email matched the account and that 20,225 users were affected.
What is known
| People affected | 20,225 (as reported by the organization) |
|---|---|
| Disclosed | Jan 11, 2026 |
| Discovered | May 2026 |
| Happened | Jan 7, 2026 |
| Attack | AI or model |
| Data exposed | Emails, Location, Phone numbers, Dates of birth, Messages, Other, Credentials and tokens |
| Sector | Tech · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Instagramhaveibeenpwned.com · Aggregator | Aggregator |
| Over 20,000 Instagram accounts stolen in Meta AI support hackbleepingcomputer.com · News | News |
| Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting accesstechcrunch.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Have I Been Pwnedaccounts in the data | Jan 11 | 6,215,150 |
| Researchtotal | Jun 1 | 20,225 |
| Researchtotal | Jun 8 | 20,225 |
History of this record
- 2026-09-25 · data_types: ["emails","location","phone","dob","messages","other"] to ["emails","location","phone","dob","messages","other","credentials"] · seed source
- 2026-09-25 · discovered: empty to 2026-05 · seed source
- 2026-09-25 · summary: Meta disclosed that its AI-powered High Touch Support tool failed to check that a password reset email matched the account, letting attackers take over 20,225 Instagram accounts without 2FA starting April 17, 2026. Account content, direct m to Hackers asked Meta's AI-powered support assistant to add attacker email addresses to Instagram accounts and send reset links, taking over accounts without 2FA. Meta said a bug in a separate code path failed to check the email matched the ac · seed source
- 2026-09-25 · title: Attackers abused Meta AI support tool to hijack 20,225 Instagram accounts to Attackers tricked Meta AI support assistant into hijacking 20,225 Instagram accounts · seed source
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/Instagram to https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/ · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · attack: scraping to ai-model · seed source
- 2026-09-25 · data_types: ["emails","location","phone"] to ["emails","location","phone","dob","messages","other"] · seed source
- 2026-09-25 · records_basis: hibp to organization · seed source
- 2026-09-25 · records: 6215150 to 20225 · seed source
- 2026-09-25 · summary: In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum . The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geoloca to Meta disclosed that its AI-powered High Touch Support tool failed to check that a password reset email matched the account, letting attackers take over 20,225 Instagram accounts without 2FA starting April 17, 2026. Account content, direct m · seed source
- 2026-09-25 · title: empty to Attackers abused Meta AI support tool to hijack 20,225 Instagram accounts · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.