Instagram Admits a Security Bug Allowed the Breach of High-Profile Accounts

Earlier this year, hackers managed to break into the Instagram accounts of several celebrities, one of them being the account of singer Selena Gomez which is currently the most popular account on the social media with over 125 million followers. At the end of last month, Instagram admitted in a statement for TIME that there had been a security bug in the service that allowed the unauthorized access and the stealing of personal information and photos from high-profile users.

Without providing any specific details on the vulnerability, the company said that exploiting the bug provided the attackers with access to users' information like the e-mail address used for creating the hacked profile, and the phone number used in the two-factor authentication process.

Instagram did not reveal whether the attack targeted a specific high-profile user. However, the company confirmed that at least one attacker has discovered the security bug, and has exploited it to obtain illegal access to the personal information stored in the hacked accounts.

Instagram claims that the hackers have not stolen any passwords, and have not had access to any other information apart from the e-mails and phone numbers of the compromised accounts. The company also says it has already contacted the owners of the breached accounts and warned them to take additional security measures. The researchers also advised all other Instagram users to be careful about the safety of their accounts, especially if they receive messages and/or calls from an unrecognized source.

After the breach of Selena Gomez' account, the hackers leaked nude pictures of her ex-boyfriend Justine Bieber. At the same time, however, independent cybersecurity researchers say that there cannot be any relation between the bug that Instagram announced and the breach into the singer's profile. The experts claim that exploiting that concrete flaw in the Instagram's application programming interface would not have allowed access to the account itself. Thus, speculations continue, and users still cannot feel safe that their data is protected until there is more clarity on the issue.