Instagram Denies Data Breach After Surge in Unsolicited Password Reset Emails and Claims of 17.5 Million User Records Leaked

Instagram has firmly denied suffering a data breach following a wave of legitimate password reset emails sent to numerous users without their request. The company explained that it quickly resolved a technical issue that permitted an unidentified external party to trigger these automated reset notifications through the platform. Instagram emphasized that its systems were not compromised and assured users their accounts are safe, advising them to ignore the emails unless they initiated the reset themselves. The incident sparked widespread concern and confusion on social media, with some users initially mistaking the messages for phishing attempts—though the links and process were verified as genuine. Cybersecurity firm Malwarebytes amplified the alarm by claiming cybercriminals had stolen and were selling personal details of 17.5 million Instagram accounts, including usernames, email addresses, phone numbers, partial physical addresses, and other data, supposedly from a 2024 leak now circulating on hacker forums. Their post, including a screenshot of a reset email, garnered over 2.3 million views. Malwarebytes connected the reset surge directly to this data sale. However, some security experts countered that the dataset likely derives from older publicly scraped information dating back to around 2022, rather than a new internal breach, as it contains no passwords and matches patterns of aggregated public profile data. Instagram did not disclose further details about the external party or respond to specific inquiries. Users are recommended to proactively strengthen security by changing passwords directly through the official app or website and enabling two-factor authentication to mitigate any potential risks from exposed information.