Got an Instagram password reset email? Is it a data breach or a viral claim?

Recently, a wave of unexpected password reset emails has alarmed numerous Instagram users, prompting speculation about a possible data breach. Cybersecurity experts at Malwarebytes reported that approximately 17.5 million Instagram accounts may have been compromised, with sensitive information such as usernames, physical addresses, phone numbers, and email addresses allegedly being sold on the dark web. As news of the breach spread, many users confirmed receiving the password reset emails, including Troy Hunt, the founder of the data breach tracking site Have I Been Pwned. Hunt expressed confusion over the situation, questioning whether it was a result of scraping or another issue. Despite the alarming reports, some researchers noted that Instagram itself had not experienced a recent hack. They suggested that the data in question might actually originate from a 2022 API leak that circumvented the platform's security measures, leading to a global profile scraping. Further investigation by the International Cyber Digest indicated that the leaked data likely stemmed from the 2024 API breach, which involved the acquisition of 489 million records. Their analysis suggested that the original data dump was created in 2022 and was possibly shared publicly in 2023. Even older data from 2017 might be included, contributing to the extensive list of exposed personal information. Seb, a cybersecurity and OSINT researcher, provided additional insights, specifying that the leak file was created on June 20, 2022, and shared via a cloud service on March 24, 2023. He pointed out that while the data was initially scraped in the past, it appears to be circulating now. In response to the growing concerns, Meta, the parent company of Instagram, denied any breach of their systems. A spokesperson reassured users that they had resolved an issue that allowed external parties to request password reset emails. They emphasized that Instagram accounts remain secure and encouraged users to ignore unsolicited reset emails, apologizing for any confusion. Regardless of the breach's timeline, the exposure of personally identifiable information poses significant risks. Although reports suggest that passwords were not part of the leak, the combination of email addresses and phone numbers could facilitate SIM swapping attacks or sophisticated social engineering scams. In light of these developments, Instagram users are urged to enhance their security by enabling multi-factor authentication, ideally through an authenticator app rather than SMS alerts. Users should be cautious about unsolicited password reset emails and can monitor their digital footprint by utilizing services like Have I Been Pwned or Malwarebytes' digital footprint scanner to check for any data breaches affecting their accounts.