Instagram data leak affects 17.5 million users worldwide

In early January 2026, a major cybersecurity incident involving Instagram triggered global alarm as reports emerged about a potential leak of sensitive user data affecting millions of accounts. This situation has rapidly become one of the most widely discussed digital privacy stories of the year, as media outlets, cybersecurity firms, and Instagram itself weighed in on what exactly occurred and whether users’ accounts were compromised.

What Exactly Happened?

Cybersecurity researchers  most notably the security company Malwarebytes  identified a large dataset reportedly containing personal information tied to roughly 17.5 million Instagram accounts. The exposed data allegedly includes:

• Full names

• Instagram usernames

• Verified email addresses

• Phone numbers

• User IDs

• Partial geographic or location information

According to reports, this dataset first appeared on hacker forums and dark web marketplaces, where a threat actor using the alias “Solonik” claimed to be distributing the information. The file was described as a 2024 API leak, suggesting the data was obtained through an exposed Instagram interface rather than direct hacking of Instagram’s internal systems.

CyberPress.org’s coverage describes this incident as a “major data leak” that has left millions of users vulnerable, especially since the information circulating is quite detailed compared to simple username lists.

Also Read: Instagram Now Allows 3-Minute Long Reels

Password Reset Emails: Breach or Glitch?

Following the leak’s discovery, many Instagram users  worldwide  reported receiving unexpected password reset emails from the platform. These emails appeared genuine, came from official Instagram addresses, and urged users to change their passwords.

The sudden surge in these notifications raised widespread concern and sparked speculation that accounts were actively being attacked or taken over.

However, Meta (Instagram’s parent company) responded publicly, stating that there was no breach of its internal systems. According to Meta, the issue stemmed from a technical problem that allowed an external party to trigger reset emails for certain users   but no unauthorized access to accounts actually occurred. Meta reassured users that accounts remained secure and urged people to ignore reset emails they didn’t initiate.

Where Did the Data Come From?

Although there is still debate, cybersecurity analysis suggests the leaked data may have come from a vulnerability in Instagram’s API that allowed large-scale data harvesting (“scraping”) in 2024. An API leak like this can expose information that users might not expect to be publicly available  especially when combined with phone numbers and locations.

This kind of scraping does not necessarily mean Instagram was directly hacked in the traditional sense, but it reveals weaknesses in how data can be collected and exploited when safeguards fail.

Why This Matters: Risk to Users

Even if Instagram’s core systems weren’t breached, the leaked information still poses serious risks:

• Phishing attacks: With names, emails, and phone numbers exposed, cybercriminals can craft highly convincing phishing campaigns.
• SIM-Swapping & social engineering:  Shared personal contact details can make users vulnerable to attackers trying to intercept authentication codes or manipulate account recovery.
• Targeted scams : Detailed user profiles enable more sophisticated fraud efforts than random spam attacks.

Security experts also warn that passwords were not part of the leak  but that information alone can be powerful in skilled attackers’ hands.

What Instagram & Meta Are Saying

Despite widespread reporting on the data leak, Meta has publicly denied that a breach occurred that compromised its systems or allowed access to passwords. Instead, the company insists the password reset incidents were caused by a “technical issue” rather than direct hacking, and that user accounts remain safe if standard security practices are followed.

Meta has also advised users to be cautious, particularly about unsolicited messages or reset prompts  and to rely on official channels when checking account security.

How to Protect Yourself

In light of this incident, cybersecurity experts recommend the following best practices for Instagram users:

1. Enable Two-Factor Authentication (2FA): This significantly enhances login security, preferably through an authenticator app rather than SMS.

2. Use Strong, Unique Passwords: Avoid reusing passwords across sites.

3. Ignore Unsolicited Emails: Do not click on links in password reset emails unless you initiated the request.

4. Monitor Account Activity: Regularly review your security settings and login history.

5. Secure Email Accounts Too: Since many recovery workflows rely on your email, protect it with robust security.