More than 20,000 Instagram accounts were stolen after the security breach of Meta’s AI support chat

More than 20,000 Instagram users have had their accounts stolen due to the attacks perpetrated against the artificial intelligence (AI)-powered support system for resetting Instagram and Facebook passwords that became known last week.

Last week it became known that a bug allowed Meta’s new artificial intelligence support assistant to be used to steal high-profile Instagram accounts by asking the chatbot to change the email address associated with the target account.

In an incident notification letter sent to US Attorney General Aaron Frey by Meta’s Associate General Counsel and Chief Legal Officer for Incident Response, Amber Hannah, the company confirmed that up to “30 Instagram users in Maine” have been affected for this violation.

In fact, in the notification letter you can read that The incident occurred on April 17which would be the exact date of the first attack received using this security gap in the new AI support program launched by Meta in December of last year.

Meta has mentioned that it has no information about the personal data that has been accessed or stolen, but cites that the attackers could have obtained access to contact information, dates of birth, publications on the social network and their content as well as direct messagesto account activity and connected accounts and services.

Bleeping Computer reports that the total number of users who were affected by this breach amounts to 20,225 and they are, precisely, all those who did not have two-factor authentication (2FA) activated in your accounts.

Hannah stated in the letter that “the tool was working correctly, but due to a bug in a separate code path, the system was not verifying that the email address provided matched with the email address associated with that user’s Instagram account.”

Last week it was revealed that attackers took advantage of the HTS (High Touch Support) system not checking whether email addresses were associated with targeted Instagram accounts, so they obtained password reset links that allowed them to hijack accounts that did not have two-factor authentication (2FA) enabled.

Meta’s Vice President of Communications, Andy Stone, took to his X (formerly Twitter) account to reply to one of those affected, maintaining that the problem had already been resolved and that they were securing the impacted accounts.

Meta’s next step was disable AI-powered HTS support service and all password reset links that had been generated to prevent possible account takeovers as part of the campaign carried out by the attackers.

Meta plans to relaunch the servicealthough not before fixing the authentication system to ensure proper verification before moving on to the password reset.