Instagram says it fastened a bug that allowed risk actors to mass-request password reset emails, amid claims that knowledge from greater than 17 million Instagram accounts was scraped and leaked on-line.
“We fastened a difficulty that allowed an exterior get together to request password reset emails for some Instagram customers,” a Meta spokesperson advised BleepingComputer.
“We wish to reassure everybody there was no breach of our programs and other people’s Instagram accounts stay safe. Folks can disregard these emails and we apologize for any confusion this will have brought about.”
A media frenzy over an alleged Instagram knowledge breach started after Malwarebytes warned its prospects that cybercriminals had stolen knowledge from 17.5 million accounts.
This alleged Instagram knowledge was launched without spending a dime on quite a few hacking boards, with the poster claiming it was gathered by means of an unconfirmed 2024 Instagram API leak.
In complete, the shared knowledge incorporates 17,017,213 Instagram account profiles, together with telephone numbers, person names, names, bodily addresses, e-mail addresses, and Instagram IDs.
Not all of this info is current for every file, with some containing as little as simply an Instagram ID and a username.
Cybersecurity researchers on X declare [1, 2] that the scraped knowledge is from a 2022 API scraping incident, however haven’t supplied any clear proof to substantiate this.
Moreover, Meta advised BleepingComputer that it isn’t conscious of any API incidents in 2022 or 2024.
Nevertheless, Instagram has beforehand suffered from API scraping incidents, akin to a 2017 bug that was exploited to scrape and promote the private info of an alleged 6 million accounts.
It isn’t clear whether or not the newly leaked Instagram knowledge is a compilation of the 2017 leak and extra info from the previous couple of years.
BleepingComputer contacted the one who leaked the Instagram info to substantiate when it was stolen, however didn’t obtain a response.
Instagram denies a breach
There may be at the moment no proof that this incident represents a brand new Instagram knowledge breach. Meta says it isn’t conscious of any API compromises in 2022 or 2024 and that there has not been a brand new breach.
Moreover, researchers haven’t supplied proof that the leaked dataset was obtained by means of a current vulnerability.
As an alternative, the knowledge suggests the information could also be a compilation of beforehand scraped info from a number of sources over a number of years.
The excellent news is that this leaked knowledge doesn’t comprise passwords, so there isn’t a want to alter them.
Nevertheless, individuals do want to remain vigilant towards focused phishing, smishing (textual content phishing), and social engineering assaults that make the most of this info.
It is not uncommon for risk actors to make use of leaked knowledge to attempt to steal further info, akin to a person’s password.
When you obtain an Instagram password reset e-mail or textual content codes to your telephone quantity and didn’t provoke an account restoration, then merely ignore and delete them.
When you do not need two-factor authentication enabled in your account, it’s strongly advisable that you simply flip it on to extend your safety.
It is finances season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the yr forward. This report compiles their insights, permitting readers to benchmark methods, establish rising tendencies, and evaluate their priorities as they head into 2026.
Find out how high leaders are turning funding into measurable impression.
