Instagram hacker bypasses 2FA and login notifications...how!??

edwardbarnett

                                                Hey everyone,

        A couple days ago I had my first experience being hacked on Instagram. How it happened is something I cannot figure and its seriously bugging me. I use a password manager that generates a strong password to secure to my account. I have 2 factor authentication set up and my choice was to use the password managers one time password as the authenticator as well as sms code. I have login notifications on as well so anytime I login I get an email and a push notification. I also have suspicious login attempt notifications on. Upon waking up the other day, I received a text from a few friends alerting me I was hacked. I did not receive a email login notification nor did I receive a push notification or suspicious login attempt notification. I did not receive a text with a 2-step code. Thankfully in my case, my password was not changed. I was able to open Instagram as usual and logout the other person who signed in. They were signed in from Germany. Here's what I do not understand, I logged in on my PC to change my password, immediately I got an email and push notification alerting me of a suspicious login attempt that requires my approval. Why did this not happen when said hacker logged in?

        I know most "hacks" are phishing except I've only ever been logged in on my phone and I have never used a third party app to sign in with my Instagram. I also change my password every 6 months out of fear of being hacked since its happened to multiple of my friends. Does anyone know how it is possible that they were able to by pass 2-factor and login notifications?