Instagram

Disclosed Jan 11, 202620,225 affectedUnverified

Attackers tricked Meta AI support assistant into hijacking 20,225 Instagram accounts

Hackers asked Meta's AI-powered support assistant to add attacker email addresses to Instagram accounts and send reset links, taking over accounts without 2FA. Meta said a bug in a separate code path failed to check the email matched the account and that 20,225 users were affected.

What is known

People affected	20,225 (as reported by the organization)
Disclosed	Jan 11, 2026
Discovered	May 2026
Happened	Jan 7, 2026
Attack	AI or model
Data exposed	EmailsLocationPhone numbersDates of birthMessagesOtherCredentials and tokens
Sector	Tech · US
Status	Unverified: not yet confirmed by an official notice, a filing or the organization
Check your email	Have I Been Pwned

Sources

Aggregatorhaveibeenpwned.com

Have I Been Pwned: Instagram

Newsbleepingcomputer.com

Over 20,000 Instagram accounts stolen in Meta AI support hack

Newstechcrunch.com

Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access

Notices filed

Accounts in the dataJan 11

Have I Been Pwned6,215,150 people

TotalJun 1

Research20,225 people

TotalJun 8

Research20,225 people

History of this record

data_types2026-09-25

["emails","location","phone","dob","messages","other"] to ["emails","location","phone","dob","messages","other","credentials"]by seedSource

discovered2026-09-25

empty to 2026-05by seedSource

summary2026-09-25

Meta disclosed that its AI-powered High Touch Support tool failed to check that a password reset email matched the account, letting attackers take over 20,225 Instagram accounts without 2FA starting April 17, 2026. Account content, direct m to Hackers asked Meta's AI-powered support assistant to add attacker email addresses to Instagram accounts and send reset links, taking over accounts without 2FA. Meta said a bug in a separate code path failed to check the email matched the acby seedSource

title2026-09-25

Attackers abused Meta AI support tool to hijack 20,225 Instagram accounts to Attackers tricked Meta AI support assistant into hijacking 20,225 Instagram accountsby seedSource

source_type2026-09-25

aggregator to pressby seedSource

source_url2026-09-25

https://haveibeenpwned.com/Breach/Instagram to https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/by seedSource

country2026-09-25

empty to USby seedSource

attack2026-09-25

scraping to ai-modelby seedSource

data_types2026-09-25

["emails","location","phone"] to ["emails","location","phone","dob","messages","other"]by seedSource

records_basis2026-09-25

hibp to organizationby seedSource

records2026-09-25

6215150 to 20225by seedSource

summary2026-09-25

In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum . The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geoloca to Meta disclosed that its AI-powered High Touch Support tool failed to check that a password reset email matched the account, letting attackers take over 20,225 Instagram accounts without 2FA starting April 17, 2026. Account content, direct mby seedSource

title2026-09-25

empty to Attackers abused Meta AI support tool to hijack 20,225 Instagram accountsby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.

Everything about Instagram