Meta Discloses 20K Instagram Accounts Hijacked via AI Support Tool

Attackers exploited a vulnerability in Meta's AI-powered High Touch Support tool to hijack approximately 20,000 Instagram accounts, gaining access to passwords, direct messages, posts, and profile information.

Public reporting from BleepingComputer and SecurityWeek indicates that the flaw allowed unauthorized password resets without proper email verification. The breach primarily affected accounts that lacked two-factor authentication. Meta has since disabled the High Touch Support tool, added new security checkpoints, and notified law enforcement. The company plans to reach out directly to those whose accounts were compromised.

This incident matters because your Instagram account is often linked to your real identity, email address, phone number, and other online services. When attackers control it, they can lock you out, send messages to your contacts pretending to be you, or harvest personal details that make further identity theft easier. For families, the risk extends to teenagers and children who use Instagram or share devices, turning one compromised account into a gateway that exposes the entire household.

The doxxing and identity-chain implications are serious. A single account takeover frequently cascades into credential stuffing attacks across other platforms. Available reporting describes how stolen Instagram data, including direct messages and linked emails, can be combined with information from previous breaches to map connections between usernames, phone numbers, and real-world identities. This creates persistent exposure long after the original incident, enabling harassment, targeted scams, or full identity theft.

What to do

• Rotate the password you used for Instagram anywhere it is reused and immediately enable two-factor authentication through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, followed by no-subscription cleanup of exposed data.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children's gaming accounts, which often chain back to the same email addresses or phone numbers used for Instagram.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf while you focus on securing your accounts.

The speed with which this Instagram breach unfolded shows that waiting for notifications is no longer enough. Start your DoxxScan trial today for continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage that includes children's gaming accounts. DoxxScan is also effective for protecting gaming accounts because credential leaks like this one cascade into account takeovers and doxxing chains.