Millions of Instagram users are receiving unexpected emails prompting them to reset their passwords due to a reported leak of account details. Instagram has responded by reassuring users that the data of over 17 million users has not been compromised and there has been no breach. Users are being advised to exercise caution when interacting with such emails.
Security experts recommend refraining from clicking on suspicious password reset links in emails, noting that attackers would still need additional information to gain unauthorized access to accounts. A cybersecurity writer, Davey Winder, disclosed receiving a seemingly authentic email from Instagram requesting a password reset. The email contained a prominent “Reset Password” button and a message stating that the password would remain unchanged if the request was ignored.
Reports indicate that sensitive information from more than 17 million Instagram records was leaked by a threat actor named “Solonnik.” The data was reportedly obtained during an API leak in 2024, where the hacker circumvented standard security measures to harvest the information. The dataset was allegedly shared for free on the cybercrime platform BreachForums.
Instagram has confirmed addressing an issue that allowed external parties to request password reset emails on behalf of some users. They emphasized that their systems were not breached, and user accounts remain secure. Instagram advised recipients of such emails to disregard them and apologized for any confusion.