Meta incidents spread across connected assets
A compromised Instagram profile can lead to a seized Facebook Page, unknown Business Manager administrators, disabled ads, and changed billing details. Recovering one login does not prove the rest of the asset graph is clean.
The response begins with an asset inventory and the last known trusted admin state. This supports a more coherent case and reduces the chance that an attacker retains a hidden role after the visible account returns.