Meta Discloses 20K Instagram Accounts Hijacked via AI Support Tool: Ransomware Claim — What’s Alleged & What To Do

Meta reported on June 5, 2026, that approximately 20,000 Instagram accounts were compromised after attackers exploited a vulnerability in an internal AI-powered support tool. The incident enabled unauthorized password resets that bypassed normal email verification steps, with particular impact on accounts that lacked two-factor authentication. The disclosure indicates that Meta notified relevant authorities, disabled the affected tool, added further security checkpoints, and plans to contact the users whose accounts were taken over. Data types referenced in connection with the event include account access details, password-reset functions, profile information, direct messages, and posts.

Inside the incident

The reported compromise centered on a flaw in Meta's High Touch Support (HTS) tool. Attackers used the vulnerability to reset passwords without completing standard verification, allowing them to take control of accounts. The issue was more readily exploitable on accounts that did not have two-factor authentication enabled. Meta has stated that it has since disabled the tool and introduced additional controls while preparing notifications for affected users. No further information has been released on the initial access method, the duration of the activity, or any specific timeline beyond the June 2026 disclosure date.

Inside bravox

Public detail on the threat actor's involvement in this specific incident is limited. The group bravox has been referenced in connection with the event, and any listing on its part constitutes an unverified claim rather than confirmed attribution from the victim organization.

Who is Meta?

Meta operates large-scale social media platforms, including Instagram, that manage user accounts, private communications, and content at significant volume. Organizations in this sector routinely process authentication data, profile details, and messaging records as part of normal service delivery. A compromise at this scale draws attention because it directly affects account control and the confidentiality of user-generated content.

The information in question

The disclosure identifies account-access, password-reset, profile-info, dms, and posts as data types involved. Exact contents of any exfiltrated material have not been itemized beyond these categories. Social media platforms of this type commonly hold email addresses, usernames, linked phone numbers, and message histories, but the precise scope of exposure in this case remains unconfirmed outside the stated categories.

The real-world impact

Individuals whose accounts were accessed may experience unauthorized posting, message interception, or further attempts to leverage the accounts for additional activity. Organizations face the operational task of restoring account access, notifying users, and addressing regulatory reporting requirements. The incident underscores the consequences when support tools that can alter authentication status contain exploitable weaknesses.

Were you affected?

If you receive a notification from Meta, follow the instructions provided to regain control of the account and review recent activity. Enable two-factor authentication on all accounts where available and monitor for unusual login attempts. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public records of incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.