Instagram Password Reset Flaw Briefly Exposed Private Data of High-Profile Users On 6 June 2026, a security flaw in Instagram’s password reset tool temporarily exposed the private email addresses and phone numbers of high-profile users, including Meta CEO Mark Zuckerberg and football star Kylian Mbappé. The vulnerability stemmed from a logic bug in the website’s code, which failed to mask sensitive contact details during password reset requests displaying full information instead of the usual redacted format (e.g., m@fb.com*). The issue gained widespread attention after screenshots of Zuckerberg’s exposed details circulated on social media, with cybersecurity accounts like vx-underground and International Cyber Digest highlighting the flaw. The latter also revealed that Mbappé’s hidden TikTok account, not publicly linked to his identity, was compromised in the same incident. Meta confirmed the bug was not the result of a system breach but rather a programming error. The company deployed an emergency fix within hours, stating that no mass data theft occurred. However, experts noted the exposure violated Meta’s own privacy policies and could potentially breach EU GDPR Article 25, which mandates data protection by design. The incident underscores broader security challenges for Instagram, which has faced multiple issues in 2026. In January, scammers exploited its password system to send millions of fake emails, while a separate dark web leak allegedly exposed 17.5 million user records. Earlier this month, threat actors also hijacked high-profile accounts, including those of the White House archive and US Space Force, by manipulating Meta’s AI customer service chatbot through prompt injection attacks. While Meta emphasized that the password reset flaw was contained, the exposure of sensitive details raises risks of phishing, SIM-swapping, and targeted account takeovers. No CVE tracking number has been assigned to the vulnerability as of reporting.