Contact information, direct messages and connected accounts were all potentially compromised, Meta said.

Hackers used Meta AI to hack into 20,225 Instagram accounts, Meta reported in a US local government data breach notice on 5 June.

According to the notice to the attorney general for Maine, the breach occurred on 17 April, but wasn’t discovered by the company until more than a month later, on 31 May.

The company explained that hackers exploited a now-resolved bug in its AI-assisted support tool designed to help Instagram users access their account after being locked out.

“HTS (high touch support) is an AI-assisted support tool designed to help users who are locked out of their Instagram accounts regain access,” said Amber Hannah, Meta’s associate general counsel for incident response.

“Users can request support from HTS and, as part of that process, can ask that a password reset link be sent to their email address.

“The tool itself worked properly and functioned as intended; however, due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account.”

The bug allowed hackers to avoid triggering Instagram’s automated account protections, enabling password reset links to be sent to an email not connected to the account. Bad actors were then able to reset passwords to gain access to victims’ accounts if they did not have two-factor authentication enabled.

The hack affected prominent figures’ accounts, including the inactive Instagram handle for the Obama-era White House, beauty retailer Sephora and a senior US Space Force official.

Meta said that hackers could have potentially accessed sensitive data, including contact information, direct messages and communications, and connected accounts and linked services, such as email IDs. The company said that it would fix the bug before relaunching the AI tool.

In 2024, the Irish Data Protection Commission (DPC) fined Meta €251m for a 2018 data breach affecting approximately 29m Facebook accounts. The same year, the watchdog fined Meta €91m for improperly storing passwords.

In 2023, the company was fined €1.2bn by the DPC for violating GDPR guidelines by transferring users’ personal data outside of the EU.

AI-enabled cybercrime is fast becoming a sore point for companies, as attacks become more frequent and sophisticated. Just last month, hackers stole 8TB of data from the Taiwanese electronics manufacturer Foxconn, while medical equipment manufacturing giant Stryker was hit by a global cyberattack in March.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.