Received an Instagram password reset email? Here’s what you need to know

Last week, unsolicited emails from Instagram about a password reset were reported by many users, while a cybercriminal offering data on about 17 million Instagram accounts appeared on a Dark Web forum. The 17 million records reportedly include usernames, full names, user IDs, email addresses, phone numbers, countries and partial locations, though the data is said to list no passwords.

Instagram denied a connection between the two events, stating that they fixed an issue that allowed an external party to request password reset emails for some people, according to X. Malwarebytes’ Shahak Shalev noted there are indications the data dump may include information from older breaches and that the earliest password reset requests came days before the data appeared on the dark web, suggesting the data may have circulated privately prior to public posting.

The article urges scepticism of the emails and recommends using the app to change passwords if desired, while prioritising 2FA and checking recent logins across related accounts.