Instagram announced to its users in North America that more than 17 million accounts may have been subject to unauthorized access, after this was revealed by the American company Malwarebytes, which indicated that an unknown party was able to obtain this data.
In a statement issued on Sunday, the platform clarified that it was able to fix the glitch that allowed a third party to send password reset requests for some users. Instagram confirmed that its systems were not breached and that accounts are secure.
The cybersecurity company Malwarebytes revealed in a post on the “X” platform that “cybercriminals” stole sensitive data belonging to about 17.5 million Instagram accounts, including usernames, mailing addresses, phone numbers, email addresses, and other information.
Instagram is ranked as the third largest social network in the world after Facebook and YouTube, with more than 2.4 billion active users. This makes it an attractive platform for influencers and marketers, and at the same time, a potential target for hackers seeking access to users’ personal data.
We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure.
You can ignore those emails — sorry for any confusion.
— Instagram (@instagram) January 11, 2026
