An abuse of Meta's Instagram High Touch Support (HTS) AI-powered account recovery tool allowed attackers to reset passwords by requesting reset links sent to email addresses not linked to the targeted accounts. This occurred due to a bug in a separate code path that did not properly verify that the provided email matched the account's registered email. Attackers exploited this to gain control over accounts lacking two-factor authentication. Meta disabled the tool, invalidated reset links, reset passwords, and enrolled affected accounts in security checkpoints. The total potentially impacted accounts number approximately 20,000, including high-profile targets. Meta is notifying users and recommending enabling 2FA. The vulnerability was discovered on May 31, 2026, and reported to authorities.

Attackers were able to take over Instagram accounts by exploiting a flaw in the password reset process, affecting roughly 20,000 accounts. Unauthorized parties could reset passwords and access accounts without 2FA enabled. Potentially compromised data includes profile information, email addresses, phone numbers, dates of birth, direct messages, social media posts, and account activity history. High-profile accounts were among those compromised and reportedly sold on the dark web. The incident undermines user account security and privacy.

Meta has disabled the vulnerable High Touch Support tool and will only re-enable it after fixing the underlying bug. Password reset links generated by the exploit have been invalidated. Affected accounts have been reset and enrolled in mandatory security checkpoints. Meta plans to notify impacted users and recommend reviewing security settings and enabling two-factor authentication. Users should enable 2FA to protect their accounts from unauthorized access. No further action is required until Meta re-enables the tool with a fix.