AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedIdentity (basic)PIILowContained

META PLATFORMS, INC.

bd_e29555e87f819f7a · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2026

Filed

Jun 19, 2026

To disclose

—

Affected

37state residents only

Linked

4 filings

Confidence

68%

Full breach record for META PLATFORMS, INC. →

Meta Platforms Inc notified the Nebraska Attorney General on June 5, 2026, regarding a vulnerability in its Instagram 'High Touch Support' (HTS) AI-assisted account recovery tool. Discovered on May 31, 2026, the bug allowed unauthorized password resets for 37 Nebraska users. Meta contained the incident by disabling the tool, invalidating reset links, and enforcing security checkpoints. Potentially accessible data included contact info, DOB, and social media content.

J jump to incidentP pin to compareR raw source

Incident timeline

May 31, 2026

Discovered

Jun 19, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_875b031b45da02852026-06-05 · +14dCandidate
Maine State AGbd_96c9850c2e2ecf652026-06-05 · +14dVerified
Illinois State AGbd_cb0f73086d31b8102026-06-01 · +18dVerified

Name: META PLATFORMS, INC.
norm: meta platforms
Domain: meta.com

Name: META PLATFORMS, INC.
norm: meta platforms
Domain: meta.com
Industry: Technologyllm

Discovered: May 31, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 37state-resident count only
Data types: Identity (basic)PII
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Disabled the AI-assisted support tool removing the vulnerable code path from production
Invalidated all existing password reset links that had been generated through the vulnerable path
Enrolled all potentially affected accounts into a mandatory security checkpoint requiring authentication before any account access
Instructed impacted users to reset their passwords and re-authenticate through secure, verified channels
Changes made: Fix the authentication check in the Instagram recovery entry point to ensure proper verification of email addresses against existing account information before any password reset is initiated
Conducting a comprehensive review of similar account recovery flows across Meta’s platforms to identify and remediate any potential issues
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJun 1 · first

California State AG+4d

Maine State AG+4d

Nebraska State AG+18d · this page

Pattern: first filing Jun 1 (IL), last Jun 19 (NE) — a 18-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/dd2321c3-57e4-4ad1-a34a-2659556d7b3b.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 19, 2026
Raw hash: 30acdd1465a8d91efd6ed58c35759174b10051b604b1c331b3ac828476b477d6

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMETA PLATFORMS, INC.

Victim entityMETA PLATFORMS, INC.

Incidentdiscovered May 31, 2026

Stated responseDisabled the AI-assisted support tool removing the vulnerable code path from production

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov