Cybercriminals are believed to have used a bug to successfully steal the account details of millions of Instagram users.
The hackers claim to have stolen sensitive information tied to more than six million Instagram accounts.
Instagram’s 50 most-followed accounts are believed to have been included in the hack.
The Facebook-owned social network will not confirm exactly how many accounts were affected, other than to say that it’s a “low percentage of Instagram accounts”.
Instagram now boasts more than 700 million active accounts, of which six million have been compromised in this latest cyberattack, hackers claim.
vCard.red is a free platform for creating a mobile-friendly digital business cards. You can easily create a vCard and generate a QR code for it, allowing others to scan and save your contact details instantly.
The platform allows you to display contact information, social media links, services, and products all in one shareable link. Optional features include appointment scheduling, WhatsApp-based storefronts, media galleries, and custom design options.
Users’ passwords were not exposed in the hack, Instagram confirmed.
However, contact information for a number of high-profile celebrities appears to be drifting around the Dark Web.
Emma Watson, Emilia Clarke, Zac Efron, Leonardo DiCaprio, Victoria Beckham, Harry Styles, Beyoncé, Taylor Swift, Rihanna, Katy Perry, Adele, Floyd Mayweather and Ronaldinho, are all believed to have been compromised in the attack.
The leak could force these users to have to ditch their current phone number, email address – or both.
A blog post by Instagram co-founder and chief technical officer Mike Krieger has confirmed the bug which enabled the leak has now been fixed.
“We quickly fixed the bug, and have been working with law enforcement on the matter,” Krieger wrote.
“Although we cannot determine which specific accounts may have been impacted, we believe it was a low percentage of Instagram accounts.
“Out of an abundance of caution, we encourage you to be vigilant about the security of your account, and exercise caution if you observe any suspicious activity such as unrecognised incoming calls, texts, or emails.”
Instagram recommends users report any unusual activity on your account via its in-built reporting tools.
To do this, tap the “…” icon in the menu from your profile, select “Report a Problem” and then tap “Spam or Abuse”.
If you’re worried about the details of your Instagram account becoming public, it’s worth checking the website haveibeenpwned.
This free database tracks online breaches and allows anyone to check whether their email address has been included in a public leak.
If your email address is not present, then chances are, it has not been included in a data dump on the open web.
The handy website, which is run by security researcher Troy Hunt, will tell you when the breach occurred and exactly what information was impacted.
You can also sign-up for alerts tied to any of your email addresses, so you will be notified as soon as another breach is picked up by the site.