Instagram account breach report: Meta denies claims, says 17 million accounts remain secure

Instagram

• Meta denies reports of a breach affecting 17 million Instagram accounts
• Password reset emails were triggered but no unauthorized access occurred
• Meta urges users to enable two-factor authentication and review account security

Did our AI summary help?

Meta has denied reports claiming that data linked to nearly 17 million Instagram accounts was exposed in a breach, stating that its systems were not compromised and that user accounts remain secure. The clarification comes after a surge in user complaints about unexpected password reset emails, which triggered concerns of a large-scale data leak.

What sparked the breach concerns

Over the past week, several Instagram users across regions reported receiving password reset notifications that they did not request. The issue gained wider attention after cybersecurity firm Malwarebytes alleged that information related to about 17.5 million Instagram users was being offered for sale on the dark web. According to the firm, the data allegedly included usernames, email addresses, phone numbers, and in some cases physical addresses.

These claims led to speculation that Instagram had suffered a significant data breach, prompting users to change passwords and share their experiences on social media platforms, particularly X.

Meta’s response

In a statement issued to Hindustan Times, a Meta spokesperson rejected the breach claims. The company said it had identified and fixed an issue that allowed an external party to trigger password reset emails for some Instagram users. Meta stressed that this activity did not involve unauthorized access to its systems or user accounts.

“We fixed an issue that allowed an external party to request password reset emails for some Instagram users. There was no breach of our systems, and people’s Instagram accounts remain secure,” the spokesperson said. Meta added that users who received such emails can safely ignore them and apologised for the confusion caused.

What data was reportedly involved

Malwarebytes maintained that the exposed dataset contained personal information that could be misused for phishing or scam campaigns. However, Meta has not confirmed any exposure of user data and maintains that no sensitive information was accessed from its infrastructure.

As of now, no independent verification has confirmed that the alleged dataset originated from Instagram’s internal systems.

What users should do

While Meta insists there is no breach, cybersecurity experts generally advise users to remain cautious. Users are encouraged to enable two-factor authentication, avoid clicking links in unsolicited emails, and regularly review account security settings. Changing passwords as a precautionary step is also recommended, especially if similar emails were received.

The bigger picture

Incidents involving password reset emails are not uncommon across major platforms and are often linked to automated abuse rather than direct breaches. Meta’s statement aims to reassure Instagram’s global user base amid heightened sensitivity around data privacy and online security. For now, the company maintains that Instagram accounts remain safe and that the issue has been resolved.