If you received a bunch of password reset requests from Instagram recently, you’re not alone. Malwarebytes, an antivirus software company, initially reported that there was a data breach revealing the “sensitive information” of 17.5 million Instagram users. Malwarebytes added that the leak included Instagram usernames, physical addresses, phone numbers, email addresses and more. However, Instagram said there was no breach and that user accounts were “secure.”
In Malwarebytes post, the company added that the “data is available for sale on the dark web and can be abused by cybercriminals.” Malwarebytes noted in an email to its customers that it discovered the breach during its routine dark web scan and that it’s tied to a potential incident related to an Instagram API exposure from 2024.
The reported breach has resulted in users receiving several emails from Instagram about password reset requests. According to Malwarebytes, the leaked information could lead to more serious attacks, like phishing attempts or account takeovers. In response, Instagram posted on X that users can ignore the recent emails requesting password resets.
“We fixed an issue that let an external party request password reset emails for some people,” Instagram’s post on X read. “There was no breach of our systems and your Instagram accounts are secure.”
While Instagram said this isn’t a data breach, its parent company has been in hot water for data breaches in the past. If you haven’t already, it’s always a good idea to turn on two-factor authentication and change your password. Even better, you can review what devices are logged into your Instagram account in Meta’s Accounts Center.
Update, January 11, 2026, 11:10AM ET: This story and its headline have been updated with Instagram’s statement that was posted on X.
