INSTAGRAM EXPOSED USERS' DATA, BY ACCIDENT

Instagram has notified some users that their password might have been exposed due to a security bug, according to The Information.

An Instagram spokesperson says that the issue was "discovered internally and affected a very small number of people". The bug was tied to a feature that the company rolled out in April, which allows users to download their data, implemented after European lawmakers rolled out its General Data Protection Regulation (GDPR).

According to Instagram some users who used the feature had their passwords included in a URL in their web browser, and that the passwords were stored on Facebook's servers, Instagram's parent company. A security researcher told The Information that this would only be possible if Instagram stores its passwords in plain text, which could be a larger and more concerning security issue for the company.

Instagram says that it has since fixed the feature so that passwords won't be exposed, and told users that they should change their passwords as a precaution. In a statement, an Instagram spokesperson said that "if someone submitted their login information to use the Instagram 'Download Your Data' tool, they were able to see their password information in the URL of the page. This information was not exposed to anyone else, and we have made changes so this no longer happens."