Instagram denies breach amid claims of 17 million account data leak

Instagram has confirmed addressing a critical bug that allowed threat actors to mass-request password reset emails, leading to the scraping and alleged leak of data for over 17 million user accounts.

• Vulnerability: An unspecified bug in Instagram's system allowed for the large-scale triggering of password reset email requests.
• TTPs:
  • Account Enumeration: The core vulnerability enabled threat actors to validate the existence of a large number of user accounts by initiating password reset emails. (MITRE ATT&CK: TA0007 - Credential Access, often as a precursor to T1589.002 - Gather Victim Identity Information: Email Addresses)
  • Data Scraping: Leveraging this enumeration, threat actors reportedly scraped associated data, though the specific method of data extraction post-enumeration isn't detailed.
• Impact: Alleged leak of data from more than 17 million Instagram accounts. Instagram denies a breach but confirms the bug fix.

Defense: Monitor for unusual patterns and volume in password reset requests, and enforce robust API rate-limiting and anti-enumeration controls on sensitive endpoints.

Source: https://www.bleepingcomputer.com/news/security/instagram-denies-breach-amid-claims-of-17-million-account-data-leak/