The service ensures your email and birthday will not be publicly available while signing up for an Instagram account.
However, a bug found by security researcher Saugat Pokharel made it so that an intruder could get that private information easily.
After being reported to Facebook, the bug, which was patched, was exploitable by company accounts who were granted access to an experimental feature the company was testing.
The attack used the Business Suite tool from Facebook, accessible for any Facebook business account.
The experimental update meant that the Business Suite tool would display additional information about an individual alongside any direct message, including their allegedly private email address and birthday if the Facebook business account was connected to an Instagram account.
All business users had to do was send a direct message to call up the details on Instagram.
Pokharel discovered that the attack operated on private accounts and accounts that were configured not to allow DMs from the public.
If DMs were not approved by an account, the user would theoretically not have received any notification suggesting that their profile could be accessed.
Pokharel, an accomplished bug hunter, also found that back in August, Instagram was not actually removing deleted messages.
A Facebook spokesperson said in a statement sent to The Verge that the bug was only accessible for a brief period of time, as the experiment began in October.
The company does not reveal how many users were granted access to the feature, but it says it was a “small test,” and that there was no proof of abuse found in an investigation.
Below is the complete text of the sentence;
A researcher reported a problem where, if anyone was part of a small test we conducted for business accounts in October, personal details might have been exposed about the person they were messaging.
This problem was easily resolved, and we found no signs of wrongdoing. We compensated this researcher through our Bug Bounty Program for his assistance in reporting this problem to us.
Facebook engineers, according to Pokharel, solved the problem within a few hours of being notified.