Massive Instagram data breach leaks info of over 17 million users

Instagram, the popular social media platform owned by Meta, is reportedly at the center of a massive data breach that has compromised the personal information of millions of users. The incident has heightened concerns about digital privacy and the security measures employed by major tech companies.

Scale and Content of the Leak

According to media reports citing cybersecurity firm Malwarebytes, personal data from at least 17.5 million Instagram accounts has been leaked and made available on the dark web. The exposed information reportedly includes user names, full names, email addresses, phone numbers, and partial physical addresses. While account passwords were not part of the leaked dataset, security experts warn that the compromised contact details can still be exploited for targeted phishing attacks, identity theft, and financial fraud.

Origin and Publication of the Data

Cybersecurity publication CyberInsider traced the breach to a vulnerability in Instagram's API dating back to 2024. Hackers allegedly bypassed Meta's security protections to scrape sensitive user data. This dataset was subsequently published this week on the hacking forum BreachForums by a threat actor using the alias “Solonnik,” who offered the information free of charge. Following the leak, users in multiple regions reported an unusual surge in password reset emails, indicating possible account targeting.

Response and Broader Implications

As of early January, Meta has not issued an official public statement confirming the breach. Instagram's help pages note that receiving a password reset email does not automatically mean an account has been hacked, but cybersecurity analysts are urging users to exercise caution. This incident occurs amid growing scrutiny of data protection practices within the social media industry and affects a global user base, including both private individuals and public influencers.