A massive breach exposed data of 17.5M Instagram users

A massive data breach exposed the personal information of about 17.5 million Instagram users, according to Malwarebytes Labs researchers. Exposed data includes usernames, physical addresses, phone numbers and email addresses, with the breach prompting mass password-reset emails from 10 January 2026.

The researchers found a sensitive database for sale on a cybercrime forum described as a “doxxing kit” affecting nearly 18 million users, and the data is believed to have been linked to Instagram user IDs and external data sources to reveal real names and home addresses.

By linking online identities to physical addresses, the breach raises concerns beyond spam or account hijacking, including potential stalking, swatting, extortion and identity theft, and portions of the database are reportedly being auctioned on illicit marketplaces, according to The Cybersec Guru. The article notes that attackers may have combined data from data brokers and other sources, and warns that the exposed information could already be circulating on the dark web.

Users are advised to verify emails from official sources, avoid password-reset links received outside the app, enable app-based two-factor authentication and review third‑party app permissions. According to Malwarebytes.