Instagram says accounts ‘are safe’ after wave of suspicious password reset requests

If you happen to obtained a bunch of password reset requests from Instagram not too long ago, you are not alone. Malwarebytes, an antivirus software program firm, initially reported that there was a knowledge breach revealing the “delicate data” of 17.5 million Instagram customers. Malwarebytes added that the leak included Instagram usernames, bodily addresses, cellphone numbers, e mail addresses and extra. Nonetheless, Instagram said there was no breach and that consumer accounts had been “safe.”

In Malwarebytes put up, the corporate added that the “information is on the market on the market on the darkish internet and will be abused by cybercriminals.” Malwarebytes famous in an e mail to its prospects that it found the breach throughout its routine darkish internet scan and that it is tied to a possible incident associated to an Instagram API publicity from 2024.

The reported breach has resulted in customers receiving several emails from Instagram about password reset requests. In response to Malwarebytes, the leaked data may result in extra critical assaults, like phishing makes an attempt or account takeovers. In response, Instagram posted on X that customers can ignore the current emails requesting password resets.

“We fastened a difficulty that permit an exterior celebration request password reset emails for some folks,” Instagram’s put up on X learn. “There was no breach of our techniques and your Instagram accounts are safe.”

Whereas Instagram mentioned this is not a knowledge breach, its guardian firm has been in sizzling water for data breaches up to now. If you have not already, it is all the time a good suggestion to activate two-factor authentication and alter your password. Even higher, you’ll be able to overview what gadgets are logged into your Instagram account in Meta’s Accounts Heart.

Replace, January 11, 2026, 11:10AM ET: This story and its headline have been up to date with Instagram’s assertion that was posted on X.