Meta has denied reports of a large Instagram data breach after claims surfaced that data of 17.5 million users appeared on the dark web.
The reports caused panic among users after many received unexpected password reset emails.
The issue came to light after cybersecurity firm Malwarebytes found a data file posted on a dark web forum.
The post claimed to contain personal details of Instagram users worldwide. Meta responded quickly, saying its systems were not hacked.
What Meta Says About the Incident
Meta said the issue was not a breach. The company explained that an external party abused a feature that sends password reset emails.
According to Meta:
- No systems were hacked
- No accounts were taken over
- User data remains safe
- The issue is now fixed
Meta added that the attacker could only trigger password reset emails. They could not access accounts or passwords.
The company said it is still reviewing reports but found no proof of unauthorized access to its internal systems.
Also read about: Instagram Statistics 2026
What Security Experts Found and Why It Matters
Malwarebytes reported that the leaked data appeared on a dark web forum on January 7. The post was shared by a user named “Solonik.”
The dataset allegedly included:
- Instagram usernames
- Email addresses
- Phone numbers
- Full names
- Partial physical addresses
Security experts believe the data may have come from API scraping in late 2024. The structured format suggests automated data collection. Some experts said weak rate limits may have allowed this activity.
Soon after, users across many countries reported receiving password reset emails. These emails looked real and came from Instagram’s official domain. This raised fears of hacking.
Malwarebytes warned that criminals could misuse this data. Risks include:
- Phishing attacks
- SIM swap fraud
- Account takeover attempts
Experts advise users to stay alert and take safety steps:
- Change Instagram passwords
- Enable two-factor authentication
- Use authenticator apps, not SMS
- Avoid clicking links in unknown emails
India may face higher risk due to its large Instagram user base of over 480 million users.
Why this matters
Even without a confirmed breach, leaked user data can still cause harm. Users should act fast to protect their accounts. Platforms must also strengthen controls to prevent data misuse.
More News To Read:
