By 
Meta has confirmed that it fixed a vulnerability in Instagram’s password reset system that allowed third parties to trigger password reset emails for users. The company emphasized that no data breach occurred and that user accounts remain secure, despite widespread claims of leaked user data.
The issue came to light after users began reporting unsolicited Instagram password reset emails starting January 10, 2026. According to reports, nearly one million users received such emails, creating confusion and fears of a large-scale cyberattack. Meta has not disclosed technical details about the flaw but assured that its systems were not compromised.
Despite Meta’s assurances, security experts have raised concerns about potential privacy risks. Researchers at Malwarebytes reported discovering a sensitive database being sold on a cybercrime forum, described as a “doxxing kit” affecting nearly 18 million Instagram users. Unlike previous data scrapes, this dataset allegedly includes physical home addresses linked to Instagram user IDs.
Researchers believe the data may not have originated solely from Instagram. Instead, attackers may have combined Instagram user IDs with information from external sources such as data brokers, marketing databases, e-commerce platforms, or previously leaked customer records to associate usernames with real-world identities and addresses.
The exposure of physical address data significantly escalates the risk, enabling real-world threats such as stalking, swatting, extortion, and identity theft—transforming what might appear to be a digital privacy issue into a serious personal safety concern.
Further adding to the concern, Have I Been Pwned (HIBP) reported that a dataset containing over 17 million Instagram records was shared on a popular hacking forum. The dataset reportedly includes 6.2 million email addresses, along with usernames, display names, account IDs, and in some cases, geolocation data.
HIBP clarified that the scraped data appears unrelated to the recent password reset emails, despite the timing overlap, and stated there is no evidence that passwords or other sensitive authentication data were compromised.
Meta continues to maintain that Instagram accounts remain secure and has advised users to ignore unsolicited password reset emails.
