Instagram stated there has been no security breach, despite some users receiving suspicious-looking password reset requests.
A Friday post on Bluesky by antivirus firm Malwarebytes shared a screenshot of an Instagram email notifying users of a password reset request. The post claimed, “Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more.” Malwarebytes added that this data “is available for sale on the dark web and can be abused by cybercriminals.”
Instagram later posted on X that it had “fixed an issue that let an external party request password reset emails for some people.” The company did not disclose details about the external party or the specific technical issue. It concluded, “You can ignore those emails — sorry for any confusion.”
