Hackers may have hijacked more than 20,000 Instagram accounts using Meta’s chatbot

الأداة نفسها تعمل بشكل صحيح وتعمل على النحو المنشود؛ However, due to an error in a separate code path, the system did not properly verify that the email address provided by the person requesting a password reset matched the email address associated with that user’s Instagram account. As a result, when someone provides an email address that is not previously associated with the account, the system incorrectly sends a password reset link to the unassociated email instead of denying the request. This allowed unauthorized third parties to receive a password reset link for accounts they did not own.

Saying company They were affectedincluding the old White House account of former President Barack Obama, US Space Force Chief Master Sergeant John F. Bentevna, and Sephora. In the notice, Meta adds that it is “not aware” of whether any personal data was accessed as a result of the exploit, but notes that the account hijackers could have obtained email addresses, phone numbers, dates of birth, social media posts, direct messages, profile information, account activity, and connected accounts.

يقول الإشعار أن 30 من المستخدمين المتأثرين يعيشون في ولاية ماين. The number refers to “users who had their passwords reset through the support tool, did not have two-factor authentication enabled on their accounts and whose Instagram accounts were potentially accessed by an unauthorized party” — though Meta says it’s “the upper limit,” as some of these accounts may have been accessed legitimately.

The company notes that it disabled its AI support tool and removed the faulty code path, invalidating any password reset links created using this exploit. It also registered all potentially affected accounts “in a mandatory security checkpoint that requires authentication before any account can be accessed.”