Instagram Denies Data Breach Amid Claims of 17 Million Accounts Leaked
- Securityish
- Privacy & Personal Security
Quick Summary
Instagram has addressed claims of a data leak affecting over 17 million accounts, stating that a bug allowed external parties to request password reset emails. Meta, Instagram’s parent company, insists there was no breach of their systems and that users’ accounts remain secure. The leaked data reportedly includes usernames, email addresses, and physical addresses, but does not contain passwords, minimizing immediate risk to users.
The Securityish Brief
Instagram recently faced allegations of a data breach involving 17.5 million accounts, which were reportedly scraped and leaked online. A spokesperson for Meta stated that they fixed a bug that allowed unauthorized password reset requests but emphasized that there was no breach of their systems. The leaked data, which includes usernames, email addresses, and physical addresses, was shared on various hacking forums, raising concerns among users.
Cybersecurity researchers suggest that the data may stem from a 2022 API scraping incident, although Meta denies any knowledge of such an incident. The leaked dataset reportedly contains 17,017,213 Instagram account profiles, with varying levels of information included for each account. Some records only contain an Instagram ID and username.
Despite the lack of evidence for a new breach, users are advised to remain vigilant against phishing and social engineering attacks that may exploit the leaked information. Threat actors often use such data to attempt to steal additional information, including passwords.
What Users Should Know
Instagram users should be cautious if they receive unexpected password reset emails or text codes. If you did not initiate a password recovery, it is recommended to ignore and delete these communications. Enabling two-factor authentication on your account can significantly enhance your security and help protect against unauthorized access.
While the leaked data does not include passwords, the incident highlights the ongoing risks associated with data scraping and the importance of maintaining strong security practices. Users should regularly review their account settings and be aware of potential phishing attempts that may arise from such leaks.
Key Takeaways
- Ignore any unexpected Instagram password reset emails or text codes if you did not initiate a recovery.
- Enable two-factor authentication on your Instagram account to enhance security.
- Regularly review your account settings and privacy options to ensure they are up to date.
- Stay vigilant against phishing attempts that may use leaked data to target you.
- Monitor your accounts for suspicious activity and report any unauthorized access immediately.
Key Terms & Concepts
- API scraping: In this article, API scraping refers to the unauthorized extraction of data from an application programming interface.
- phishing: Phishing is a fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
- two-factor authentication: Two-factor authentication is a security process that requires two different forms of identification to access an account.
Read the original article here: https://www.bleepingcomputer.com/news/security/instagram-denies-breach-amid-claims-of-17-million-account-data-leak/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
