Instagram kept deleted messages and pictures on its servers for more than one year.
After security researcher Saugat Pokharel asked for a copy of his photos and direct messages (DMs)from the company, he was sent data he had deleted more than 12 months previously.
Instagram said this was due to a bug in the system and awarded Pokharel a "$6,000 bug bounty" for highlighting the issue.
An Instagram spokesperson told TechCrunch: "The researcher reported an issue where someone's deleted Instagram images and messages would be included in a copy of their information if they used our Download Your Information tool on Instagram. We've fixed the issue and have seen no evidence of abuse. We thank the researcher for reporting this issue to us."
