Report: Facebook notified some Instagram users that a now-fixed bug in its data download tool sent their passwords in plaintext in a URL that the users received
According to The Information, Instagram has suffered a serious security leak of its own that could've exposed user's passwords.
Context & Ripple Effects
The notification lands mid-pattern: a year earlier, Instagram disclosed a [[a:921840|bug in its API that breached high-profile accounts and exposed phone numbers and email addresses]]. Now the data download tool — built in response to Europe's data-portability push — becomes its own leak vector, sending users their own passwords in plaintext inside a URL.
What makes the story bigger than one bug is what followed in the corpus: months later Facebook said it would notify hundreds of millions of Facebook users and thousands of Instagram users that passwords were stored in readable format, then revised that upward to millions of Instagram users in plain text. The 2018 tool bug was an early data point in a string of credential-handling failures at the same company.
First-order effects
- Affected Instagram users had their passwords transmitted in a URL — meaning the credential could persist in browser history, server logs, and any intermediary that logs addresses — prompting Facebook to send direct notifications telling them what happened.
Second-order effects
- Each disclosure compounds scrutiny of Facebook's security practices: the March 2019 readable-password notification covering hundreds of millions of accounts forced a second correction when the Instagram figure grew from thousands to millions, extending the news cycle rather than closing it.
Third-order effects
- A pattern of initial undercounting followed by upward revision — thousands becoming millions — points toward regulators treating self-reported breach figures as a floor, not a fact, raising the cost of every subsequent incident for Facebook and Instagram.
The trend: Facebook's credential handling is shifting from isolated bugs to a recurring trust-and-regulatory liability, where each fix surfaces another exposure and each disclosure gets revised larger.