Massive leak on Instagram: data of 17.5 million accounts exposed

During this beginning of 2026, an unusual activity related to massive password reset requests has been detected. Both regular users and profiles with a large number of followers have been targeted by these messages, which appear completely legitimate and come from the social network’s usual channel. In most cases, recipients had not requested the password change. The volume and frequency of the emails made it suspect that it was more than just an isolated error. Quickly, debates and alerts arose on social networks, fueled by the feeling that it could be a serious security problem.

What’s happening with Instagram accounts

On January 9, the antivirus software company Malwarebytes published details about a data breach that, according to their investigations, put a huge number of accounts at risk.

You can also read:Protests in Nepal occur after ban on the use of Facebook, Instagram, YouTube and other social networks

The company assured that a group of cybercriminals managed to steal confidential information from 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, and email addresses. The discovery of this data set on a cybercrime forum raised the alarm, as it was not a simple automated extraction, but a complete and functional “doxing kit”.

The hypotheses about the mechanism of the attack pointed to two possibilities: an automated brute force attack generated multiple password change requests to sow confusion and, among the legitimate messages, try to sneak in a malicious email; or Meta, the company that owns Instagram, had initiated a preventive password reset on accounts considered compromised. For its part, Instagram addressed the rumors, pointing out that the incident was due to a “software problem” that allowed a third party to request password reset emails for some people. He flatly denied that there had been unauthorized access to their servers or a breach of their systems. In their statement, the company assured:  “There was no breach of our systems and your Instagram accounts are safe”. The statement concluded with apologies to users affected by the inconvenience caused.

What is the real risk that Instagram users are experiencing now

The difference between both stories is significant. Malwarebytes points to a massive data breach and commercialization of personal information on the black market, which implies risks in both the digital environment and real life.

Instagram, on the other hand, minimizes the scope and reduces it to a failure in sending password reset emails, without consequences for the integrity of accounts or the data stored in its systems. The details published by Malwarebytes reinforce the thesis of a serious incident: the leaked data includes real names, physical addresses, phone numbers, and email addresses. The information would be sold in batches classified by country and number of followers, prioritizing high-profile accounts such as those of influencers or companies. Instagram, for its part, insists that no attacker managed to access the servers or obtain data from within the platform. In its version, users received unsolicited password change messages, but their accounts remained protected at all times.

What to do if you are a victim of this attack

Given this scenario, the recommendation is to act with caution and not interact with any links received via email, even if the message appears authentic. Do not click on links that appear in emails, no matter how real they seem.

If you receive an unexpected notification to reset your password, the safest thing to do is to change it directly from the application by following the path: ‘Settings and activity’ > ‘Account Center’ > ‘Password and security’ > ‘Change password’. It is advisable to choose a long, strong and unique password for Instagram.

We recommend reading: Britney Spears deactivates her Instagram account after a new dispute with her ex-husband Another key measure is to activate two-factor authentication from the security section of the application. Experts recommend avoiding the SMS-based option and opting for authentication applications for more robust protection. Closing open sessions on all devices, reviewing the ‘Instagram Emails’ section in the settings, and deleting any suspicious messages completes the list of preventive actions. If any email outside of the official channels is detected, it should be deleted immediately and reported to the platform.