The recent wave of Instagram account reset emails which impacted 17.5 million users didn’t rely on sophisticated exploits. Instead, it exposed something closer to home, which really is around the weaknesses in standard account recovery processes combined with predictable user behaviour. Like clicking the ‘reset password’ link when the email from Instagram comes through. ​“Meta said that this incident was not a breach or hack but stemmed from a bug in Instagram’s password-reset function that was exploited. The problem is that in 2022, Instagram’s API was scraped, collecting public or semi-public information from 17.5 million accounts,” said Zbyněk Sopuch, CTO at Safetica. At the centre of the issue was ...