One or more hackers have been stealing celebrities' e-mail addresses, phone numbers, and other personal information by exploiting a bug on Instagram's servers, the company said Thursday.

Researchers from antivirus provider Kaspersky Lab said they recently spotted hackers in an underground forum advertising unnamed celebrities' personal details. In an e-mail, a Kaspersky Lab representative said the researchers privately reported a data-leaking bug to Instagram. The Kaspersky Lab researchers went on to say that exploiting the bug was "quite labor intensive" because each attack had to be done manually rather than using an automated script to bypass mathematical calculations Instagram performs to prevent abuse.

To exploit the bug, according to Kaspersky Lab, attackers used the outdated Instagram mobile app—specifically version 8.5.1, which was released last year—to select the password-reset option. To capture the request, the attackers sent it to a Web proxy rather than the real Instagram servers. The attackers then modified the captured request to substitute the username sent to the Web proxy with the username of targeted celebrities. The Instagram server would then send a JSON-formatted response that included the target's personal information. While the hackers used the outdated app to exploit the bug, the attack worked against all Instagram users, regardless of the app version they used.

A representative from the Facebook-owned photo-sharing service, meanwhile, said the exploited flaw resided in an Instagram programming interface. The representative said Instagram officials know of at least one person who actively exploited the bug. In a statement, the officials wrote:

We recently discovered that one or more individuals obtained unlawful access to a number of high-profile Instagram users' contact information—specifically email address and phone number—by exploiting a bug in an Instagram API. No account passwords were exposed. We fixed the bug swiftly and are running a thorough investigation. Our main concern is for the safety and security of our community. At this point, we believe this effort was targeted at high-profile users so, out of an abundance of caution, we are notifying our verified account holders of this issue. As always, we encourage people to be vigilant about the security of their account and exercise caution if they encounter any suspicious activity such as unrecognized incoming calls, texts, and e-mails.

The disclosure comes three days after the Instagram account belonging to pop singer and actress Selena Gomez was briefly taken down after posting nude pictures of fellow pop star and one-time romantic partner Justin Bieber. According to Variety, the mishap was the result of Gomez's account being hacked. Whether or not the account takeover had any connection to the exploited Instagram bug is unclear. Neither Instagram nor Kaspersky Lab said the attacks exposed passwords. Then again, the attackers who exploited the flaw may have used the personal information they obtained to reset Gomez's password. In any event, it's a good idea for Instagram users to use two-factor authentication to better protect their accounts.