parable

This still happens. Meta doesn't do much to protect against this, they just fire more people and hire new agents when they find out one was bribed.

It's against Meta's terms to buy and sell accounts, thus the bank would never do such a deal unless you structured it a certain way: create a business, the account becomes property of the business, then Chase buys the business and thus the account. This is how certain Twitter accounts were sold a long time ago. $10k for @chasebank (which is what I assume your handle is) is quite good regardless, though.

Meta's aware and tries their best to act on it, but the real solution is simply not hiring outsourced support workers. It's really that simple. They have the money to hire people in-house for good wages, which would solve the root issue: the outsourced workers are desperate for money and gladly will take bribes.

Correct, which is the problem here - they don't want to, and you can't force them to.

Likely a bot spamming the reset endpoint to fetch your recovery method hints. Happens all the time. I'd ignore and just sign into your account via the app or website to make sure everything's fine. WhatsApp is indeed used to send reset codes to accounts if the phone number on file is registered to WhatsApp, but I'm unsure as to how that integration actually works, as I don't use WhatsApp.

Your account might be rate limited from performing additional password resets. Try the hacked account flow by selecting "Can't reset your password" (or whatever the app says) when trying to do a password reset. That's how I was able to sign back in despite being unable to request additional reset codes.

Have you lost your username? Instagram should allow you to revert it once you're back in.

You're lucky you weren't affected by this. Several people I know with three-letter usernames had theirs stolen over the last few days.

When I recovered my account that had been stolen through this exploit (luckily, my username hadn't been changed), I was sent a code to my email address and then asked to use my TOTP code, backup code, or a video selfie. I used my TOTP code and was let in just fine. They certainly have the ability to make such a feature. Keep in mind, however, that several unpatched TFA bypasses exist for Instagram currently. People offer it as a service for around $1,000 on Telegram. Where there's a TOTP code input, there's a way to bypass it.

Or sell it, and pocket some cash for yourself. If this person has a short or otherwise valuable username, they could sell it for possibly thousands or tens of thousands of dollars.

Meta has the capability to find out who authorized the change to this person's account. They log every change done in their administrator panel with a scary level of granularity, as far as I know, and they're able to take actions against employees who go behind Meta's back and take bribes (which, in joao's case, is what happened). This enforcement creates "waves" of account thefts described like so:

Suppose Mallory finds the contact information for Alice, an Instagram employee working overseas. Alice is paid next-to-nothing and wouldn't mind Mallory's extra cash. Mallory posts to their Telegram channel: "Instagram account takeovers for sale! Pay me $5,000+ and I'll take over ANY Instagram account". Mallory gets buyers lined up and promises to take over the accounts when Alice is working. The next day, when Alice signs on to the administrator tools, she sets each account's email address to the ones specified by Mallory, and Mallory pays her a percentage of what she charged. Mallory and Alice continue their scheme for about a week, when Meta finally investigates the situation, traces it to Alice's user account, bans or reverts every account Alice helped steal, and terminates her employment. However, no legal action takes place against Alice. Why? That part, I'm not so sure about. They're able to trace every action to Alice, and Alice is not anonymous, thus they have every ability to bring a case against her. Once Alice's employment is terminated, Mallory simply finds another employee willing to do their bidding. New hiring waves make this easy.

I'm happy to go into more detail about the underground Instagram account market. It's fascinating: people bragging about bribing employees and taking advantage of them, knowing their employment will be terminated, and actively showing off how much money they make. Meta has tried in the past to hit certain high-profile people with a cease & desist letter, but those are hard to enforce in certain jurisdictions.

What about Hotmail's "eh" flaw of 1999? I'd say a two-letter password is practically "zero auth".

While I agree with this, the hackers have an incentive to get in and out as soon as possible (at least, with accounts that have valuable usernames), because they want to swap the username over to an account they fully control before the rightful owner takes the account back. While DMs were read during this exploit in some cases (I've seen this be the case for several musicians), valuable usernames were likely signed into, swapped, and then signed out of. That's how rare username theft on Instagram generally works, anyways.

This is how account recovery procedures used to work at a certain gaming company. They used to train support agents on what makes an account high-value and apply additional scrutiny to those recovery cases, while letting low-value accounts be recovered with less information. It worked, for the most part, but because the valuation of a given account was based on the agent, some agents used to value accounts differently. You could get away with stealing a high-value account if you got the right agent in a support ticket. The tradeoff in this case was time spent - you'd have to create a lot of email addresses and plausible but vague tickets, though some attackers automated that process. Eventually, they just applied the same scrutiny level against every account and called it a day.

I've said this before, too. Several people I know have used various tricks and exploits to fix problems that support teams supposedly couldn't fix.

You might be interested in reading the court case against Eric Meiggs and Declan Harrington, which includes charges against the two involving extortion and SIM swapping for usernames. See page 10: https://storage.courtlistener.com/recap/gov.uscourts.mad.215...

While it isn't directly "stealing", the government has brought charges against people in the past for username-related crimes. There are several similar cases, but this is the first one that came to mind.

Those are just bots sending reset attempts to obtain your email or phone hint. I receive hundreds per year. All you need to send a password reset link is the account's username, which is, of course, publicly accessible.

I'm inclined to believe it. As someone who studies this side of the Internet quite often and has seen equally trivial exploits stay active for weeks or months without being patched, I have no trouble believing this claim. I'm sure there are messages in Telegram channels from weeks or months ago that corroborate this.

I actually quite like this solution. Beats asking users to add a "recovery selfie" (something Meta actually does now) - I'd rather choose 3 of my friends and have them approve some notification in-app. Seems like better UX and preserves privacy a slight bit more, but we all know Meta's not in the privacy business.

As a "young person" (under 30), my thoughts: There's a minority of us that do genuinely care, possibly more than most - so hiring someone from this minority would be helpful - but the vast majority of my peers don't care about privacy nor security. They often take this defeatist mindset of "my data is already out there, why should I care?", or prefer convenience over security. For example, "why should I switch to Signal if I have a public Instagram profile?" or "I can't remember all those passwords! I just use one for everything."

As for your comment about junior engineers, see kennywinker's reply to this thread - I share the same thoughts.

I'm glad they've seemingly made some sort of public statement on X and to media outlets, though they haven't emailed affected users yet.

They have yet to acknowledge the recovery method disclosure vulnerability which was exploited on a massive scale in February. The last time I checked, email addresses and phone numbers were PII. I don't live in the EU, but someone who does should complain to the relevant authorities about that.

That's strange, the timing seems to be after the vulnerability was supposedly patched (roughly 4:30 PM PDT). Is your username short or valuable?

As far as I'm concerned, failing to report breaches like this is illegal in some jurisdictions. They already didn't report the other email address disclosure bug that was widely abused, and they likely won't report this either.

At the very least, if they really don't want to make a public statement, they should send out emails to affected users. With all the data they collect, I'm sure it's possible to run a query that selects all users who have been "recovered" by AI support and whose usernames were subsequently changed shortly after to find a victim list of some sort.

My account was also stolen but my username wasn't changed. I had TFA enabled which likely saved me, but I'm hearing that can be bypassed too. I guess I was just lucky. The attackers rate limited my account so I couldn't send any password reset emails, but I went through the hacked account recovery flow which allowed me to receive a code and log back in just fine. I received about 100 password reset emails throughout this ordeal.

No, you're forced into the A/B test. I assume they'll enable this on every account at some point. Maybe there's a way to edit your account's flags via some undocumented API endpoint, but I'm not sure. Even if that were possible, your account would likely be flagged for API abuse and banned within the day.

It's been patched now, so if your account wasn't already stolen, you're fine, at least for the time being.

Yes, all 8000+ institutions that use Canvas.

This happens to me several times a month. I'm more concerned about account termination, in that if their Gmail account is terminated for some reason, mine would be as well due to it being the backup email address.

This is actually a great analogy for why companies should take small data leaks seriously. A leak is a leak.

Also, to clarify, I don't mean to appear as though I'm discrediting this leak or downplaying its severity. I only mentioned that it was a partial leak to offer an explanation as to why some users received emails and others didn't, as witnessme's comment seemed confused about this.

As far as I know, it only contains users who have made Substack profiles. Regular subscribers don't seem to be included, though I could be wrong.

I'd edit my other reply to this comment but can't anymore.

Here are the columns from the CSV file I've seen being shared around on forums, including the "internal metadata". This mostly boils down to full name on file, email, Stripe customer ID, activity metrics, usernames, and phone numbers. Everything else is largely irrelevant.

id,name,email,email_confirmed,email_confirmation_token,stripe_platform_customer_id,is_global_admin,is_ghost,created_at,anonymous_id,email_bounce_count,photo_url,publisher_agreement_accepted_at,bio,updated_at,profile_set_up_at,tos_accepted_at,email_digest_at,has_passed_captcha,import_confirmation_required,post_notification_preference,reader_installed_at,activity_items_viewed_at,dismissed_ios_app_promo_at,email_notifications_last_resumed_at,previous_name,release_group,handle,phone,bank_payment_failures,is_globally_banned,session_version

I'm fairly sure even mentioning the name of the forum isn't allowed on HN. It should be trivial to find it yourself, though. I also replied to someone else with the CSV headers if you're only trying to find out what exactly was included in the leak: https://news.ycombinator.com/item?id=46932380

Also, keep in mind that this is a partial leak. The data was scraped from some leaky endpoint which was patched out before every user could be scraped. Only users who were in the partial leak received emails (I have two accounts, only one received an email). If you're a Substack user but didn't receive an email, I'd assume you're not in the leak. Troy Hunt should load it into HIBP eventually, and those concerned can check there if they don't want to seek the leak out on their own.

I've seen the leaked data posted on forums. I'm assuming they're trying to minimize the bad PR from this incident by only doing what's legally required, which is to notify affected users. They're likely not obligated to notify the broader public. Whether they should be obligated to do so is another discussion entirely.