Bug bounty hunter Arne Swinnen discovered two vulnerabilities in Instagram that allowed him to brute-force Instagram account passwords and take over user accounts with minimal efforts. Both vulnerabilities were exploitable due to Instagram’s weak password policies and its practice of using incremental user IDs. Facebook has since patched both the vulnerabilities by limiting the number of login attempts as well as hardening its password policy. Instagram now requires passwords to be a combination of numbers, letters, and punctuation. The company recommends Instagram passwords not be used elsewhere online.
Source: https://thehackernews.com/2016/05/hack-instagram-account.html