Was My Instagram Hijacked Through Meta's AI Support Assistant? How to Get It Back

In 2026 a wave of Instagram takeovers had an unusual cause: Meta's own support tooling. BleepingComputer reported Meta's data breach letter, filed with Maine's Attorney General, which said attackers exploited a bug in an AI-assisted recovery system called High Touch Support. This guide explains what happened, how to tell whether you were affected, and how to recover safely.

Last checked: 29 October 2026 against the sources listed at the end of this guide.

#What happened with Meta's AI support tool?

According to Meta's letter, the tool could send a password reset link to an email address supplied by the person asking for help. Because of a bug in a separate code path, it did not check that the email matched the account. Attackers used this to receive reset links for accounts they did not own and log in where two-factor authentication was off. Meta said 20,225 users were affected, discovered the issue on 31 May 2026, and the filing lists 17 April as the breach date.

#How do I know if my account was one of them?

• You received an Instagram notice about this incident or were forced through a security checkpoint in June 2026.
• Your password was changed without a reset email reaching your own inbox.
• An unfamiliar email address appears in Accounts Center.
• Your account was taken over even though nobody had your password.

#How do I get my Instagram back?

1. Go to instagram.com/hacked or tap Forgot password, then Need more help, on the login screen.
2. Choose the option that says your account was hacked and follow the steps, including any video selfie request.
3. After you are back in, change your password and turn on two-factor authentication with an authenticator app.
4. In Accounts Center, remove any email, phone number or device you do not recognise.
5. Check Login activity and log out every session you do not recognise.

Meta says it secured affected accounts and asked owners to reset passwords again. If you still cannot get in, keep evidence such as emails and screenshots before trying anything else.

#What should I avoid?

Scammers use news like this to pose as Meta support. Meta will not DM you a recovery link on Instagram, WhatsApp or Telegram, and it never charges to restore an account. Read our guide to real and fake Instagram emails.

Related guides: Why Won't Instagram Let Me Create a New Account?.

#What common mistakes should I avoid?

• Replying to anyone who messages you claiming to be Meta support.
• Creating a new account straight away, which can look like ban evasion.
• Paying someone who promises a promised unlock.
• Sharing login codes or backup codes with anyone.

#When should I ask an expert before I act?

Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen.

AwareXone has solved 1,300+ cases and works only through official platform processes. Support is available 24 hours, every day. We never ask for your password, login codes or backup codes, and we never name our clients. Request a free case review or message us on WhatsApp. Malaysian cases are priced in MYR; other markets are quoted in USD after review.

AwareXone is independent and not affiliated with Meta, Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision.