Notifications
Clear all
Topic starter
19/08/2026 3:50 pm
TL;DR: Seventeen to 17.5 million Instagram records resurfacing alongside unsolicited password reset emails illustrates how scraped data and business logic flaws can combine into scalable abuse, even without a traditional internal breach, according to Equixly. The security lesson is that exposed public data and weak behavioural controls create a durable attack chain, not a one-off incident.
NHIMG editorial — based on content published by Equixly: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, including 46% confirmed cases and 26% suspected cases.
Questions worth separating out
Q: What breaks when scraped identity data is reused against live account recovery flows?
A: The main failure is that legitimate identity workflows become abuse channels.
Q: Why do public identity records increase fraud and phishing risk even without passwords?
A: Public identity records give attackers enough context to build believable lures, target high-value accounts, and automate enumeration.
Q: How can security teams tell whether an identity workflow is being abused at scale?
A: Look for repeated requests from diverse IPs, unusual timing patterns, mismatched user behaviour, and requests that trigger sensitive actions without corresponding account activity.
Practitioner guidance
- Audit public identity exposure Inventory which usernames, emails, phone numbers, and location attributes are externally visible across your applications and APIs, then assess how those fields could be repurposed for phishing, credential stuffing, or whaling.
- Test sensitive workflows for abuse Run adversarial tests against password reset, account lookup, and verification flows to see whether valid requests can be triggered repeatedly without ownership or behavioural safeguards.
- Discover and classify shadow APIs Map all exposed endpoints that handle identity data or recovery actions, and flag undocumented or partner-facing interfaces that lack ownership, security review, or monitoring.
What's in the full article
Equixly's full blog research covers the operational detail this post intentionally leaves for the source:
- Its walkthrough of how automated API discovery exposes discrepancies between documented and actual endpoint behaviour.
- Its offensive testing approach for distinguishing human-like traffic from scraping bots, including low-and-slow request patterns.
- Its examples of how per-session quotas and endpoint-specific traffic patterns reveal hidden logic gaps.
- Its remediation framing for folding API testing into CI/CD workflows before abuse paths reach production.
👉 Read Equixly's analysis of Instagram scraping, reset abuse, and business logic flaws →
Instagram scraped data and reset abuse: what teams need to know?
Explore further
19/08/2026 4:26 pm
Public identity data has become a long-tail abuse asset, not a one-time leak. The key risk in scraped-data incidents is persistence. Once usernames, emails, phone numbers, and location hints are exposed, attackers can reuse them across phishing, fraud, and automation campaigns for months or years. That means identity governance has to account for downstream abuse, not just the original collection event. Practitioners should treat externally visible identity fields as part of their threat model.
A question worth separating out:
Q: Who is accountable when exposed identity data is combined with automated workflow abuse?
A: Accountability usually spans application owners, identity and access teams, and security operations. The key question is which team owns the workflow’s abuse controls, who validates rate and ownership checks, and who monitors anomalous activity after exposure. In regulated environments, identity data handling and abuse prevention also intersect with privacy and operational resilience obligations.
👉 Read our full editorial: Instagram scraped data shows how logic flaws extend attack life
