Instagram explains surprise password reset emails and says accounts remain secure

Instagram

• Instagram says password reset emails sent this week can be safely ignored
• No breach of Instagram's systems occurred and accounts remain secure
• Uncertainty surrounds how an external party caused mass password reset emails.

Did our AI summary help?

If you were among the many users who received an unexpected password reset email from Instagram earlier this week, the company says you can safely ignore it. Instagram has confirmed that the issue has now been resolved, though it has stopped short of explaining exactly what went wrong.

In a post on X, Instagram said an “external party” was able to trigger password reset emails for some users. The company stressed that the problem has been fixed and claimed there was no breach of its internal systems.

“We fixed an issue that let an external party request password reset emails for some people,” Instagram said. “There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion.”

Beyond that statement, Meta has provided little clarity. The company has not explained how the external party was able to generate the emails, nor how many users were affected. Meta has also not responded to requests for further comment.

The reassurance, however, sits uneasily alongside separate reports from cybersecurity firm Malwarebytes. The firm recently claimed that data linked to roughly 17.5 million Instagram accounts had appeared for sale on dark web forums. According to Malwarebytes, the exposed information allegedly included usernames, email addresses, phone numbers and even physical addresses.

Instagram has not directly addressed those claims, instead reiterating that there was no breach of its systems. It remains unclear whether the reported dataset is related to the password reset incident, originates from an older leak, or stems from data scraped via other means.

For users, the immediate risk appears limited. Instagram is not asking people to change their passwords as a result of the incident, and there is no indication that accounts were taken over. Still, the episode has caused confusion and concern, particularly given the lack of transparency around what triggered the mass emails in the first place.