A bug in Instagram that allowed criminals to steal the private information of celebrities has come to light just days after hackers took over the account of Selena Gomez to post nude pictures of Justin Bieber.
Instagram admitted that the bug within its application programming interface (API) allowed at least one person to gain access to the private email addresses and phone numbers of high-profile users.
An Instagram spokesperson said: “We recently discovered that one or more individuals obtained unlawful access to a number of high-profile Instagram users’ contact information – specifically email address and phone number – by exploiting a bug in an Instagram API.
“No account passwords were exposed. We fixed the bug swiftly and are running a thorough investigation.”
Instagram said that it was contacting all its “verified” account holders, which are mainly celebrities and sportspeople.
The exposure of the private details of celebrities comes just days after the the most popular person on the service, Gomez, who has 125 million followers, had her account compromised on Monday. Hackers posted several nude photos of her ex-boyfriend Bieber, leading to the account being suspended by Instagram.
Gomez regained control of her account and scrubbed the feed of the nude images, which were taken from Bieber’s Bora Bora holiday in 2015 and originally published in a censored format by the New York Daily News.
The API bug is unlikely to have lead to the compromise of accounts owned by Gomez and other celebrities due to the fact that account passwords were not exposed, but recovery information could have been obtained through email addresses and phone numbers, if the hackers had had further access to Gomez’s personal accounts.
This is not the first time celebrities have been targeted on Instagram. Singer Taylor Swift’s Instagram and Twitter accounts were hacked into in late January 2015. The hacker posted images of a man on a toilet among others and threatened to post nude images of Swift.
The Facebook-owned photo sharing service is warning users to be wary of unrecognised phone calls, texts and emails following the hacks and to “remain vigilant” about the security of their accounts, ensuring that they use two-factor authentication.
