Meta denies viral claims about data breach affecting 17.5 million Instagram users, but change your password anyway

Millions of Instagram users panicked over sudden password reset emails and claims that 17.5 million user data records had been stolen, while Meta denied any breach allegations.

Millions of Instagram users received emails urging them to reset passwords. Many instantly linked the requests to the reported Instagram data breach by Malwarebytes last week.

The claims originated from a post on the notorious hacker forum Breach Forums, which advertised a dump titled “INSTAGRAM.COM 17M GLOBAL USERS – 2024 API LEAK.”

The seller claimed the dataset contained data on 17.5 million Instagram users, packaged in JSON and TXT files.

According to the post, the stolen data included full names, email addresses, phone numbers, and partial location data.

However, on Saturday, Meta issued a denial, explaining that the reset emails are related to an issue with a third-party service that allowed users to generate password reset emails.

The company claimed that it had fixed the problem, but denied that the issue had led to the theft of users’ personal information.“We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems, and your Instagram accounts are secure. You can ignore those emails. Sorry for any confusion,” Instagram posted on X on Saturday.

No new Instagram breach, old data reshared

Cybernews researchers have investigated the data listed on BreachForums and confirmed that the claims by the threat actor are false.

What the threat actor reshared is data from an old leak on Doxagram, a hacker website created in 2017 to sell personal data scraped from approximately six million Instagram user accounts.

At the time, Ido Naor, a researcher for Kaspersky Lab, reported to Instagram that there was a bug in Instagram's API password reset section.

There were approximately a total of 6 million “high-profile” accounts that had their personal phone numbers and email addresses stolen.

“The current listing is a repackaged Doxagram leak from 2022, since all the records match. However, the 2022 leak was also a repackaged scrape from 2017,” Cybernews researchers explained.

“It only contains private information, such as addresses and email addresses, from 2017. All other data is publicly accessible data like usernames, names, and IDs,” our researchers added.

The current dataset presented as Instagram’s user data is identical to the dataset from 2022.

“If you look at the usernames, structure, what fields are available, sequence of accounts, it's the same.”

Unlock more exclusive Cybernews content on YouTube.