Massive Instagram data leak affects millions of users
As of January 11, 2026, a major Instagram data leak has exposed personal details of approximately 17.5 million users. The leak was first reported by cybersecurity firm Malwarebytes. A hacker known as “Solonik” posted the data on forums like BreachForums earlier this week.
Information leaked includes usernames, full names, email addresses, phone numbers, partial physical addresses, and user IDs. The dataset is already circulating on the dark web, increasing risks of scams and impersonation.
Scraping vulnerability likely caused the Instagram leak
This wasn’t a direct hack of Instagram’s servers. Experts believe the data was harvested through a vulnerability in Instagram’s API dating back to late 2024. Automated data scraping exploited weak access controls and rate-limiting protections.
Such weaknesses allowed bad actors to collect large amounts of user data over time. Though less intrusive than a full system breach, scraping can still cause significant harm if personal information is exposed.
Scroll to continue reading
Leaked data may trigger phishing and identity theft
Since the leak, many users have reported waves of suspicious password reset emails from Instagram. These emails began appearing between January 8 and 10, 2026, shortly after the dataset surfaced.
Cybercriminals may be using the leaked data to test account access, posing serious risks of phishing, impersonation, or even identity theft. Users should remain cautious and verify all security-related messages.
Instagram says systems weren’t breached
In a statement on X (formerly Twitter), Instagram claimed: “We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure.”
Meta has not confirmed the exact scale of the leak or the reported 17.5 million affected accounts. However, they insist that password reset requests do not indicate a direct system intrusion.
How to protect your Instagram account right now
Cybersecurity experts advise immediate action to secure Instagram accounts, especially for those receiving strange password reset emails. Follow these steps to protect your personal data:
- Do not click links in unexpected password reset emails.
- Change your Instagram password to a strong, unique one.
- Enable two-factor authentication (2FA) with an app like Google Authenticator.
- Review connected devices and revoke access to unfamiliar apps.
- Monitor your email and social accounts for signs of phishing or spam.
Check if your data was exposed in the Instagram breach
You can verify whether your information was part of the Instagram data leak using tools like HaveIBeenPwned.com or Malwarebytes’ breach scanning tools. These platforms alert users if their emails appear in known breaches.
If your data is compromised, take extra care with all online accounts that use the same email address. Enable security alerts where possible and avoid reusing passwords across platforms.
Why this Instagram data leak matters
This incident highlights how scraping-based data leaks can still carry serious risks. Even without direct hacks, millions of users’ details can end up in the wrong hands.
Instagram and Meta face renewed pressure to strengthen access controls and improve user protections against mass scraping. Meanwhile, users must stay vigilant and update security settings regularly.
Instagram data leaks: An ongoing privacy challenge
Large social platforms like Instagram remain attractive targets for cybercriminals. Previous incidents show that even public-facing APIs can be abused without proper safeguards.
Until stronger protections are in place, every user must take ownership of their digital safety. A few simple steps—like 2FA and password hygiene—can make a big difference in preventing account takeovers.
(If You Like/Appreciate This EURweb Story, Please SHARE it!)
MORE NEWS ON EURWEB.COM: Please Help His Girls – Keith Porter Jr.’s Family Starts GoFundMe After His Killing by Off-Duty ICE Agent
We Publish Breaking News 24/7. Don’t Miss Out! Sign up for our Free daily newsletter HERE.
