Instagram Users Warned Over Fake Password Reset Emails Linked to Major Data Leak
Instagram users are being warned to stay alert after a wave of unsolicited password reset emails began landing in inboxes, part of what cybersecurity experts believe is a broader phishing campaign linked to a past data leak.
The emails, which appear to mimic legitimate security notifications from Instagram, urge recipients to reset their passwords. Cybersecurity specialists are urging users not to click on any links in these messages, even if they look convincing.
The warning follows reports that as many as 17.5 million Instagram accounts may have been affected by a data breach, exposing information including usernames, email addresses, phone numbers, and in some cases physical addresses. That data can be used to craft targeted phishing attacks designed to trick users into handing over login credentials.
Cybersecurity firm Malwarebytes, which first flagged the breach, has advised users to proactively change their passwords and enable two factor authentication. Crucially, the company stressed that any password changes should be made directly within the Instagram app rather than through email links.
Reports of suspicious activity have been growing. Several users have taken to Reddit in recent days to share screenshots of unprompted password reset notifications, suggesting the campaign is widespread and ongoing.
Security researchers believe the phishing attempts may stem from an Instagram API leak that occurred in 2024. According to CyberInsider, the exposed data includes structured fields consistent with API responses, although other sources have not been ruled out. On January 7, 2026, a user operating under the alias “Solonik” reportedly posted what appears to be the stolen dataset on an online forum dedicated to sharing personal information obtained from breaches, offering it for free.
For users who receive a suspicious password reset email, experts recommend opening the Instagram app, navigating to Settings and activity, then Accounts Center, followed by Password and security, and selecting Change password. This ensures the request is handled securely and avoids the risk of interacting with malicious links.
Instagram users are also encouraged to enable two factor authentication through the Accounts Center. An authenticator app is considered the most secure option, while SMS based authentication is available but less robust.
While Instagram has not publicly confirmed the full scope of the breach, cybersecurity experts say the current spike in phishing attempts highlights how stolen data continues to be exploited long after an initial leak. Users are urged to remain cautious, verify account activity regularly, and treat unexpected security emails as potential threats rather than urgent calls to action.
Photo Credit: DepositPhotos.com