An Instagram Hack Hit Millions of Accounts, Victims Contact Details on Sale

If you aren’t a celebrity then chances are high that you may find yourself on the mercy side of the hackers since a group of hackers targeting A-list celebrities’ Instagram accounts may have accessed millions of users’ private data, the social media site has warned.

Singer Selena Gomez appeared to be one of the stars whose accounts were compromised during a cyber attack on the picture-sharing app last week. Three naked photos of her ex-boyfriend, Canadian star Justin Bieber, were posted to her 125 million followers before her profile was shut down.

A bug that exposed users’ contact information affected a far greater number of accounts than Instagram originally said. The bug, which appears to have been responsible for Selena Gomez’s account being this week, allowed hackers to scrape email addresses and contact information for millions of accounts. (It has since been fixed.) While the company first said the hack was limited to holders of verified accounts, it said that non-verified users had been affected as well.

Hours after the hack was disclosed, hackers established a searchable database named Doxagram allowing users to search for victims’ contact information for $10 per search. The hacker provided a list of 1,000 accounts they said were available for searching on Doxagram and the list included most of the 50 most-followed accounts on the service. Instagram still will not say how many accounts were affected, other than that it is a “low percentage of Instagram accounts.” There are more than 700 million active Instagram accounts; hackers say they have information on file for 6 million users. Users’ passwords were not exposed in the hack, Instagram said.

Contact information for dozens of celebrities now appears to be floating around on the dark web. A cybersecurity firm named RepKnight said it found what purported to be contact information for celebrities including:

• Actors: Emma Watson, Emilia Clarke, Zac Efron, Leonardo DiCaprio, Channing Tatum.
• Musicians: Harry Styles, Ellie Goulding, Victoria Beckham, Beyoncé, Lady Gaga and Rihanna, Taylor Swift, Katy Perry, Adele, Snoop Dogg, Britney Spears.
• Athletes: Floyd Mayweather, Zinedine Zidane, Neymar, David Beckham, Ronaldinho.

For celebrities and other high-profile users, the hack could mean having to change a phone number, email address, or both. But it can also be used along with social engineering techniques to gain access to the account itself. That seems to be what happened to Gomez, Instagram’s most-followed user. Her account was briefly taken down Monday after it was used to post nude photographs of Justin Bieber, her ex-boyfriend.

Today’s news is troubling on at least two fronts. One, average Instagram users may be at risk of hacking. Two, Instagram says it does not know which accounts were affected. “After additional analysis, we have determined that this issue potentially impacted some non-verified accounts as well,” Instagram co-founder and chief technical officer Mike Krieger said in a blog post. “Although we cannot determine which specific accounts may have been impacted, we believe it was a low percentage of Instagram accounts.”

The company also said it is “working with law enforcement” to combat the sale of stolen information. “We encourage people to be vigilant about the security of their account and exercise caution if they encounter any suspicious activity such as unrecognized incoming calls, texts and emails,” Krieger said. “The safety and security of our community are important to us, and we are very sorry this happened.