Instagram Fixes Password Reset Vulnerability Amid User Data Leak

Instagram fixed a password reset vulnerability that allowed third parties to send reset emails to users, Meta confirmed, amid claims of a wider user-data leak. The vulnerability, which Meta said was resolved, involved external parties being able to request password reset emails for some accounts. Meta stressed there was no breach of its systems and that user accounts remained secure, while apologising for any confusion as users reported receiving those emails.

Securityweek notes that cybersecurity firm Malwarebytes said hackers had leaked online data associated with 17.5 million Instagram accounts, though experts pointed to a 2022 data leak and later resurfacing in November 2024. Have I Been Pwned warned that a dataset of more than 17 million entries was shared on a hacking forum, including 6.2 million email addresses, with the data not appearing to be linked to the password reset issue. Written by Ionut Arghire, this report was published on 12 January 2026. according to X.