Were Instagram user data stolen? 17.5 million accounts at risk

While data such as usernames, emails, and phone numbers for millions of Instagram accounts have been shared on a hacking forum, experts state that the stolen information poses a major threat to account security.

Don't leave your news choices to an algorithm - decide for yourself what you read. Add 12punto to your preferred sources!

Were Instagram user data stolen? 17.5 million accounts at risk

Security researchers have announced that sensitive contact information for approximately 17.5 million Instagram users has been seized by hackers and circulated online. The obtained information includes usernames, full names, email addresses, phone numbers, and, in some cases, physical addresses.

There has been no official confirmation yet from Meta, Instagram's parent company, regarding this large-scale data breach. However, the cybersecurity firm Malwarebytes announced that it detected a large data set circulating during scans conducted on the dark web. Warnings issued on the subject emphasized that the data in question could be used in password reset processes and threatens the account security of millions of users.

Instagram has more than 2 billion active users worldwide, which further increases the severity of the incident. Considering the platform's vast user base, the leaked data set of 17.5 million is of a scale that could directly affect many people.

HACKERS RELEASED INFORMATION FOR FREE ON FORUMS

It was reported that the publicly available data set was shared on the BreachForums platform on January 7, 2026, by a hacker group known as “Solonik.” The post on the forum stated that the data breach was global and included account information for users from various countries. The samples added to the post present information such as usernames, email addresses, phone numbers, and user IDs as raw data. It was reported that these samples confirm the initial findings of security companies.

Cybersecurity experts emphasize that malicious actors could use the stolen data to trigger Instagram's password reset mechanism to gain access to accounts, and they are calling on users to be extra vigilant. Stating that emails or messages that appear to be ordinary password reset notifications may increase, experts advise caution against such communications.

Experts also state that they estimate the data set may be linked to a leak that occurred in Instagram's API infrastructure in 2024, and therefore, the danger in question is based on a past vulnerability.

To date, there has been no official statement from Meta, Instagram's parent company, regarding the allegations.

News Source: 12punto