Unsecured database exposed millions of Instagram influencers

A database containing contact information for millions of Instagram influencers was reportedly found online, exposing info like phone numbers and email addresses for celebrities, influencers and brand accounts. According to TechCrunch, the database was hosted on Amazon Web Services and left without a password. It contained as many as 49 million records.
 
Each record contained public data scraped from influencers' accounts. In some cases, the location of accounts, as well as owners' email addresses and phone numbers were listed. Each record also contained an estimated worth of the account, based on followers, engagement and reach.
 
Security researcher Anurag Sen found the database, and TechCrunch reportedly traced it back to Chtrbox, a Mumbai-based social media marketing firm. When TechCrunch contacted the company, the database was removed, but Chtrbox did not respond to TechCrunch's request for comment.
 
"We're looking into the issue to understand if the data described -- including email and phone numbers -- was from Instagram or from other sources," an Instagram spokesperson told Engadget. "We're also inquiring with Chtrbox to understand where this data came from and how it became publicly available."
 
According to Facebook, scraping data of any kind is prohibited on Instagram, but it's still unclear how the data was obtained or how it may have been used. In the past, we have seen hackers try to sell celebrity data scraped from Instagram, and the platform has faced its own security issues -- like storing passwords in plain text and a bug that exposed some users' passwords. As Facebook works to emphasize privacy, it will have to address Instagram's vulnerabilities as well.

---