Archive · 12 Jan 2026
Instagram Data Breach Exposes 17.5 Million Users
A lot of Instagram users got emails asking them to reset their passwords.
Some people think this is because of a big data leak where bad guys stole information like names, phone numbers, and emails from 17.5 million accounts.
A company called Malwarebytes said this happened, but Instagram's owner, Meta, said there was no new leak.
They think the data might be from a long time ago, maybe even 2017.
Instagram says their systems are safe, and people can ignore these emails.
But it's still a good idea to be careful.
People should turn on extra security steps, like using an app to get codes instead of text messages, and not click on any password reset links unless they asked for them.
There are also websites where you can check if your information was leaked.
India has the most Instagram users, and there are new laws to protect people's data, but not all parts of the law are working yet.
Over 17.5 million Instagram users' personal data, including usernames, addresses, phone numbers, and emails, reportedly compromised and sold on the dark web.
Malwarebytes claims the data is being sold on the dark web, but Meta denies any recent breach, suggesting the data may be from a 2022 API exposure.
The data likely originates from a 2022 API breach, possibly including older data from 2017.
Instagram users have reported receiving unsolicited password reset emails, but Meta advises disregarding them.
Experts recommend enabling multi-factor authentication and being cautious of potential SIM Swapping and social engineering attacks.
- Who
- Instagram users, cybersecurity firms, Meta
- What
- Unexpected password reset emails, potential data breach
- When
- Recent reports, data from 2022 (possibly 2017)
- Where
- Globally, dark web
- Why
- Data scraping, API leak, distribution of previously scraped data
Malwarebytes
Meta
Data Breach Confirmation
Malwarebytes
Confirms a data breach with 17.5 million users' data exposed and sold on the dark web.
Meta
Denies any recent breach, suggesting the data may be from a 2022 API exposure.
- Number of affected users
- 17.5 million
- Data compromised
- Usernames, physical addresses, phone numbers, email addresses
- Source of data
- 2022 API breach, possibly including data from 2017
- Meta's response
- No breach confirmed, issue fixed, emails can be disregarded
- Potential risks
- SIM Swapping attacks, social engineering, unauthorized access
- Recommended actions
- Enable multi-factor authentication, ignore unsolicited password reset emails
- India's Instagram users
- 480.55 million (as of October 2025)
- DPDP Act, 2023
- Classifies phone number and email address as 'personal data'
Sources
Did you receive a mail to reset Instagram password? Is it a data breach? Is it a 2022 claim going viral? Meta responds
Got Instagram Password Reset Email Without Asking? Is Your Account At Risk? Here's What Meta Said
Over 17.5 million Instagram users’ personal data for sale on dark web: Report
Massive data leak exposes over 17.5 million Instagram accounts – How do password reset attacks work?
Got an unexpected Instagram password reset email? Here’s what actually happened
17.5 Million Instagram Accounts' Sensitive Data Available On The Dark Web: Here's How To Stay Secure
