Summary

• A validation failure in Instagram's High Touch Support system allowed password resets to be sent to attacker-controlled email addresses.
• Meta reported up to 20,225 potentially affected accounts and said attackers may have accessed messages, profile data, contact details, and linked services.
• Meta disabled the recovery tool, invalidated vulnerable reset links, and required security checks and re-authentication for impacted accounts.
• Accounts without two-factor authentication were more exposed; reporting indicated MFA blocked the described takeover technique.
• Researchers publicly reported additional high-profile Instagram account hijackings involving Meta's automated support flow, but Meta did not confirm that every reported case belonged to the same incident.
• A separate dataset containing 17.5 million Instagram records appeared on a criminal marketplace; evidence described it as scraping rather than a direct compromise of Meta's internal systems.