A bug in Instagram's software allows hackers to access users personal information. As a result, hackers had temporary access to information like email addresses and phone numbers.
The bug was at Instagram's application programming interface (API). The vulnerability apparently allowed unauthorized parties to obtain the email addresses and phone numbers associated with Instagram accounts, even when such information was supposed to be private and inaccessible to parties other than respective account owners.
With those in hackers' disposal, they could intercept password reset messages or to phish or otherwise social engineer Instagram users.
According to Instagram:
"No account passwords were exposed. We fixed the bug swiftly and are running a thorough investigation."
The problem on Instagram's API has since been fixed, but the damage has been done.
The social network that boasts more than 700 million monthly active users, saw that Selena Gomez's account had been hacked. Gomez that is one of the most followed accounts on Instagram with 125 million followers, had hackers posting nude photos of her ex-boyfriend Justin Bieber.
The account was taken down and restored, with the nude photos deleted.
Before the bug was fixed by Instagram, hackers have apparently stole a significant amount of data that are then put on sale on a searchable database for $10 each (payable in Bitcoin). The Daily Beast claims to have verified some of the data supplied by the hackers as authentic.
The manager of the database said that he heard about the Instagram vulnerability on a private chat room, and accessed the data on August 25th.
Among the 6 million accounts whose data was stolen, about 1,000 of them are owned by celebrities, politicians and other high-profile figures. They include: Kim Kardashian, Harry Styles, Emma Watson, Adele, Victoria Beckham, Emilia Clarke, Zac Efron, Leonardo DiCaprio, Beyoncé, Taylor Swift, Snoop Dog, Lady Gaga, Ellie Goulding, Rihanna, Britney Spears, Channing Tatum, Floyd Mayweather, and according to The Daily Beast, the breached data even included the White House and U.S. President Donald Trump.
In 2019, the stolen information was used to populate a database which exposed personal information of more than 49 million Instagram influencers.
