If you’ve received an Instagram password reset email, claiming that you requested it, you should ignore it.

Malwarebytes reports that cybercriminals stole Instagram account details for 17.5 million users, but the social network claims that there was no security breach …

Many Instagram users have been reporting receiving Instagram password reset emails, stating that Meta received a request to reset the password.

Exactly what has happened isn’t entirely clear at this stage. Malwarebytes that cybercriminals stole account details for 17.5 million Instagram users.

Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more. This data is available for sale on the dark web and can be abused by cybercriminals.

says the security company attributes this to an Instagram API vulnerability.

Malwarebytes noted in an email to its customers that it discovered the breach during its routine dark web scan and that it’s tied to a potential incident related to an Instagram API exposure from 2024.

there has been no data breach.

We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion.

It seems likely that Malwarebytes is correct in its analysis of what happened, whilst Meta is technically correct that it wasn’t a data breach, since using an API provided by the company doesn’t constitute one in the strictest sense of the term, even if the API was misused.

Either way, the company’s advice applies: just ignore any password reset emails you receive. However, you should be especially alert to phishing attacks in which things like your Instagram username and email may be used to try to fool you into thinking it comes from Meta.

Image: 9to5Mac/ / on