Security / Privacy
Instagram Accounts Were Hijacked by Asking the Help Bot Nicely
A 2026 Instagram takeover incident showed that account recovery itself can become the weak link when identity checks fail.
#Security #Account Takeover #Instagram #Social Media #AI
Sometimes the password is not the weakest part of an account.
TechCrunch’s 2026 breach roundup reported that thousands of Instagram accounts were hijacked after attackers abused Meta’s AI-powered support flow. The attackers reportedly impersonated account owners and persuaded the chatbot to send password-reset codes to email addresses controlled by the attackers.
That is an important security lesson: account recovery is part of authentication.
A strong password and two-factor authentication can still be undermined if a recovery process accepts weak proof of identity.
What to check
Review the email addresses and phone numbers attached to your important accounts. Remove old recovery methods you no longer control. Review signed-in devices and active sessions. If a platform offers passkeys or phishing-resistant security keys, consider using them.
And treat unexpected password-reset messages as a signal to investigate, even when you did not request the reset.
A reset email does not automatically mean somebody got in. It does mean somebody may be testing the door.