Skip to main content

Instagram Accidentally Exposed Some Users' Passwords In Plaintext

Instagram has recently patched a security issue in its website that might have accidentally exposed some of its users' passwords in plain text.

The company recently started notifying affected users of a security bug that resides in a newly offered feature called "Download Your Data" that allows users to download a copy of their data shared on the social media platform, including photos, comments, posts, and other information that they have shared on the platform.

To prevent unauthorized users from getting their hands on your personal data, the feature asks you to reconfirm your password before downloading the data.

However, according to Instagram, the plaintext passwords for some users who had used the Download Your Data feature were included in the URL and also stored on Facebook's servers due to a security bug that was discovered by the Instagram internal team.

The company said the stored data has been deleted from the servers owned by Facebook, Instagram's parent company and the tool has now been updated to resolve the issue, which "affected a very small number of people."

Download Your Data was rolled out by Instagram in April to comply with the new European data privacy regulations, General Data Protection Regulation (GDPR), and to address the privacy concerns of users worldwide amid Facebook's Cambridge Analytica scandal.

Affected users are highly recommended to change their passwords and clear their browser history as soon as possible.

If you have not received any notification from the photo-sharing service yet, it means your Instagram account and password are apparently not affected by the bug. If you are still concerned about the privacy and security of your account, you can also consider changing your password.

Users are also advised to enable two-factor authentication (2FA) and always secure their accounts with a strong and unique password.

Facebook had recently addressed a much more severe bug linked to its "View As" feature that was being actively exploited by unknown hackers to steal secret access tokens for 30 million Facebook users.

In late August, Instagram fixed another severe flaw in its API that unknown hackers exploited in the wild to gain access to the phone numbers and email addresses for many "high-profile" users with verified accounts.

In the same month, Instagram was also reportedly hit by a widespread hacking campaign that mysteriously locked out hundreds of users of their accounts with their email addresses, account names, profile pictures, and passwords changed.

Have something to say about this article? Comment below or share it with us on Facebook, Twitter or our LinkedIn Group.
Labels:

Comments

Post a Comment

Popular posts from this blog

Information Security Analyst Interview Questions

Top 12 Information Security Analyst Interview Questions & Answers 1) Explain what is the role of information security analyst? From small to large companies role of information security analyst includes Implementing security measures to protect computer systems, data and networks Keep himself up-to-date with on the latest intelligence which includes hackers techniques as well Preventing data loss and service interruptions Testing of data processing system and performing risk assessments Installing various security software like firewalls, data encryption and other security measures Recommending security enhancements and purchases Planning, testing and implementing network disaster plans Staff training on information and network security procedures 2) Mention what is data leakage? What are the factors that can cause data leakage? The separation or departing of IP from its intended place of storage is known as data leakage.  The factors that are respons...
Post a Comment
Read more

Community Health Systems agrees to pay nearly $3.1 million as a part of settlement for 2014 data breach

The settlement covers a total of 4.5 million patients impacted in the breach. The cyber attack took place in April and June of 2014 and was orchestrated by a Chinese criminal group. Tennessee-based Community Health Systems has reached a settlement over a 2014 data breach that 4.5 million patients. A proposed amount of $3.1 million has been reached as a part of the settlement in a class action lawsuit filed against the healthcare. What happened? According to court records, the cyber attack took place in April and June of 2014 and was orchestrated by a Chinese criminal group, that solely focused on obtaining intellectual data. The hackers used an advanced malware and exfiltrated a variety of information such as patient names, Social Security numbers, addresses, dates of birth, and phone numbers. However, no credit card details and medical details were affected in the breach. Following the breach, the healthcare firm had notified the patients about the breach. However, the...
Post a Comment
Read more
Phishing Campaigns Targeting Google and Yahoo Accounts To Bypassing Two-Factor Authentication Several phishing campaigns targeting hundreds of individuals across the Middle East and North Africa. The attacker targers HRDs, journalists, political actors. Amnesty International published a report on multiple campaigns that traget self-described “secure email” services, such as Tutanota and ProtonMail and another campaign that aimed in bypassing two-factor authentication. Crafted Phishing Sites – Secure Email Providers The phishing campaign primarily targeted popular secure email service providers such as Tutanota and ProtonMail. Threat actors used a well-crafted phishing page – by obtaining the domain tutanota[.]org, whereas the original domain of the service provider is tutanota[.]com. A phishing attack is one of the dangerous social engineering attacks that leads to capture a victim’s username and password that will get store it to an attacker machine and reuse it l...
Post a Comment
Read more