Meta Platforms, Inc. has notified Instagram users that a bug in its account recovery system may have let an unauthorized party initiate a password reset and get into their accounts. According to the notice, the flaw was active between April 17, 2026, and May 31, 2026. Meta says it has since turned off the recovery tool that was misused, canceled any unused password reset links tied to affected accounts, forced new password resets, and fixed the underlying bug so the same method can’t be used again.
The notice is directed at people whose Instagram accounts could have been reached through this bug during that window. If your Instagram was linked to a Facebook or Threads account, those connected accounts may have also been accessed — Meta says it sent separate emails to secure affected Facebook accounts and in-app notifications on Threads asking users to verify their identity. If you didn’t receive one of those, your connected accounts were not affected.
What information was exposed?
- Contact information (email address and/or phone number)
- Date of birth
- Posts, photos, videos, and stories
- Direct messages
- Profile information
- Account activity
- Information available in any connected Facebook or Threads accounts, if those were also accessed
Meta’s letter does not mention any free credit monitoring or identity protection service being offered in connection with this incident.
What should you do now?
- If you haven’t already, complete the verification steps in the Instagram app and reset your password to something strong and unique that you don’t reuse on other sites.
- Log in to any connected Facebook or Threads account, complete any security checkpoints, and reset those passwords too.
- Turn on two-factor authentication for Instagram and any connected accounts if it isn’t already enabled.
- Review your account’s login activity and check for any changes to your email address, phone number, or other settings that you didn’t make.
- Watch for messages, emails, or texts pretending to be from Instagram or Meta asking for your login details — don’t click links in unsolicited messages, and go directly to the app instead.
- Since direct messages and photos may have been viewed, consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere.
- If you use your Instagram email or phone number as a recovery method on other accounts, double-check those accounts for unfamiliar activity as well.
If you have questions, Meta can be reached at [email protected].