Instagram denies data breach after reports of 17.5 million users' personal information leak

On January 10, 2026, security company Malwarebytes announced the results of an investigation into the theft of personal information from Instagram for 17.5 million users and its sale on the dark web. Instagram subsequently announced on January 11, 2026, that its systems had not been breached. However, personal information, including approximately 6.2 million email addresses and 3.5 million phone numbers, was actually being sold on the dark web.

Received an Instagram password reset email? Here's what you need to know | Malwarebytes
https://www.malwarebytes.com/blog/news/2026/01/received-an-instagram-password-reset-email-heres-what-you-need-to-know

Instagram denies breach amid claims of 17 million account data leak
https://www.bleepingcomputer.com/news/security/instagram-denies-breach-amid-claims-of-17-million-account-data-leak/

Malwarebytes discovered the following post on the dark web. The poster is offering over 17 million pieces of personal information leaked from Instagram. According to overseas media outlet BleepingComputer, the data being sold includes a total of 17,017,213 pieces of personal information. The breakdown is as follows: IDs: 17,015,503; usernames: 16,553,662; email addresses: 6,233,162; phone numbers: 3,494,383; names: 12,418,006; and addresses: 1,335,727.

Around the same time that personal information began to be sold on the dark web, many users also received emails about resetting their Instagram passwords.

On January 11, 2026, Instagram posted, 'We fixed the issue that allowed third parties to request password reset emails. We have not found any breaches in Instagram's systems and users' accounts are safe,' emphasizing that the sending of password reset emails was not the result of a breach of email addresses.

We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure.

You can ignore those emails — sorry for any confusion.

— Instagram (@instagram) January 11, 2026

'The allegedly leaked data from Instagram includes data from previous leaks, and there are several indications that it's an aggregation of multiple leaks,' said Shahak Shalev, global head of fraud and AI research at Malwarebytes. 'Also, given that the password reset emails began being sent a few days before the data sale began, it's possible that the data was circulating in private groups before the sale began.' He also mentioned another possibility: 'Malicious actors may be attempting attacks on Instagram (separate from the data sale), and Instagram may be referencing those attacks.'

Troy Hunt, the administrator of the website ' Have I Been Pwned? ', which allows users to check whether their account information has been leaked, also reported that after comparing 500 of the leaked data with data leaked in 2019, all 500 were included in the data leaked in 2019.

But what about that 100%? Well, that's the joy of having such a large corpus of data to cross-reference in a scraping incident like this. I checked 500 email addresses from this data, and literally 100% of them were in the PDL breach: https://t.co/9WUHkH0YJd

— Troy Hunt (@troyhunt) January 11, 2026

Please note that the email addresses being sold in this case are already registered in the Have I Been Pwned? database.