7 months ago
Instagram Data Breach Exposes 17.5 Million Users
A lot of Instagram users got emails asking them to reset their passwords.
Some people think this is because of a big data leak where bad guys stole information like names, phone numbers, and emails from 17.5 million accounts.
A company called Malwarebytes said this happened, but Instagram's owner, Meta, said there was no new leak.
They think the data might be from a long time ago, maybe even 2017.
Instagram says their systems are safe, and people can ignore these emails.
But it's still a good idea to be careful.
People should turn on extra security steps, like using an app to get codes instead of text messages, and not click on any password reset links unless they asked for them.
There are also websites where you can check if your information was leaked.
India has the most Instagram users, and there are new laws to protect people's data, but not all parts of the law are working yet.
Over 17.5 million Instagram users' personal data, including usernames, addresses, phone numbers, and emails, reportedly compromised and sold on the dark web.
Malwarebytes claims the data is being sold on the dark web, but Meta denies any recent breach, suggesting the data may be from a 2022 API exposure.
The data likely originates from a 2022 API breach, possibly including older data from 2017.
Instagram users have reported receiving unsolicited password reset emails, but Meta advises disregarding them.
Experts recommend enabling multi-factor authentication and being cautious of potential SIM Swapping and social engineering attacks.
- Who
- Instagram users, cybersecurity firms, Meta
- What
- Unexpected password reset emails, potential data breach
- Where
- Globally, dark web
- When
- Recent reports, data from 2022 (possibly 2017)
- Why
- Data scraping, API leak, distribution of previously scraped data
Malwarebytes
Meta
Data Breach Confirmation
Malwarebytes
Confirms a data breach with 17.5 million users' data exposed and sold on the dark web.
Meta
Denies any recent breach, suggesting the data may be from a 2022 API exposure.
Key facts
- Number of affected users
- 17.5 million
- Data compromised
- Usernames, physical addresses, phone numbers, email addresses
- Source of data
- 2022 API breach, possibly including data from 2017
- Meta's response
- No breach confirmed, issue fixed, emails can be disregarded
- Potential risks
- SIM Swapping attacks, social engineering, unauthorized access
- Recommended actions
- Enable multi-factor authentication, ignore unsolicited password reset emails
- India's Instagram users
- 480.55 million (as of October 2025)
- DPDP Act, 2023
- Classifies phone number and email address as 'personal data'
Timeline
184M Instagram passwords exposed in 2025 leak.
Users get reset emails; Meta denies 2017 breach link.
Quotes
International Cyber Digest
A cybersecurity newsletter
“The leaked information appears to be from the Instagram 2024 API breach, in which 489 million records were obtained. Further analysis shows that the original file dump was created in 2022 and shared in 2023.”
thehansindia.com
“This leak might be older than initially thought, possibly including data from 2017, which explains the phone numbers and email addresses it contains.”
thehansindia.com
Malwarebytes
A cybersecurity company
“Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more. The data could be abused by cybercriminals.”
thehansindia.com
Troy Hunt
Founder of the breach-monitoring service Have I Been Pwned
“Who knows what the story is behind this? Scraping? Other?”
thehansindia.com
Seb
An OSINT researcher
“The Instagram data leak file was created on 2022-06-20 10:37:22 and shared via a cloud service on 2023-03-24.”
thehansindia.com
Meta spokesperson
A representative of Meta, the parent company of Instagram
“We fixed an issue that allowed an external party to request password reset emails for some Instagram users. We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused.”
thehansindia.com
Sources
Did you receive a mail to reset Instagram password? Is it a data breach? Is it a 2022 claim going viral? Meta responds
Got Instagram Password Reset Email Without Asking? Is Your Account At Risk? Here's What Meta Said
17.5 Million Instagram Accounts' Sensitive Data Available On The Dark Web: Here's How To Stay Secure
Over 17.5 million Instagram users’ personal data for sale on dark web: Report
Massive data leak exposes over 17.5 million Instagram accounts – How do password reset attacks work?
Got an unexpected Instagram password reset email? Here’s what actually happened
Instagram Password Reset Scare Triggers Old Breach Fears, Meta Says Accounts Are Safe
Related news
Social Media Companies Intensify Efforts to Identify Child Users
Yorkville America Expands Beyond Trump-Linked ETFs With AI Strategy
Meta’s $18-Billion Child Safety Settlement Faces Praise and Criticism
School Awards Honour Courage, Commitment and Educational Excellence
AI Expansion Puts Jamnagar and Thane Under Water Stress
