Were 17 million Instagram accounts compromised in a recent security incident? Concerns surfaced last week after several users reported receiving unexpected password reset emails, triggering fears of a possible data breach. Cybersecurity firm Malwarebytes suggested the activity was connected to an incident that exposed data linked to nearly 17.5 million Instagram users globally. Meta, however, has rejected these claims, stating that its systems were not breached and that user accounts remain secure, dismissing reports of a large-scale data exposure. According to Malwarebytes, the purported leaked data included usernames, physical addresses, phone numbers, and email addresses. “Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more,” Malwarebytes claimed. “This data is available for sale on the dark web and can be abused by cybercriminals.”

Over the past week, Instagram users across multiple regions reported receiving password reset alerts that were not initiated by them. The situation drew more attention after cybersecurity firm Malwarebytes claimed that data linked to roughly 17.5 million Instagram users was being offered for sale on the dark web. The firm said the allegedly exposed information included usernames, email addresses, phone numbers, and, in some cases, physical addresses. The allegations sparked speculation about a major Instagram data breach, prompting many users to change their passwords and share their concerns and experiences on social media platforms, particularly X.Amid the claims, several Instagram users took to social media to share their experiences. One person wrote on X, “I’ve been getting meta emails about changing my password the last like 2 weeks.” Another said, “I got the email that mine was accessed last night. immediately changed my password.” A third person added, “Can confirm, got 2 password resets and checked to see my stuff on the data breach, change your passwords.”

Another user claimed, “Yup I just got and email from a phishing account saying my password was trying to be reset. This is a scam email! But they got my email from the data leak.”

In a statement to Hindustan Times, a Meta spokesperson denied that a data breach had occurred. “We fixed an issue that allowed an external party to request password reset emails for some Instagram users. We want to reassure everyone that there was no breach of our system,s and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused,” the Meta spokesperson said.

What should you do?

Though Facebook’s parent company Meta, insists there is no breach, cybersecurity experts generally advise users to remain cautious. Users are encouraged to enable two-factor authentication, avoid clicking links in unsolicited emails, and regularly review account security settings. Changing passwords as a precautionary step is also recommended, especially if similar emails were received. When it comes to password reset requests, Instagram itself points out that receiving one “doesn’t necessarily mean that your account has been hacked.”

“Two-factor authentication will help you protect your account so no one has access to it,” the relevant social media platform support page confirms, requiring a code in addition to the account password “if there’s a login attempt from a device that we don’t recognise.”

“To provide the highest security possible,” Instagram confirmed, “we turned on two-factor authentication for creator accounts by default.” It is also why you need to take action now, as Instagram urged all users to “check to make sure that you didn’t turn it off!”

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!