Meta fixes Instagram password reset flaw, denies data breach

Meta confirmed a password reset flaw that allowed third parties to trigger reset emails, while denying any breach of its systems; according to Instagram, there was no system breach and users’ accounts remain secure, with a note to ignore the emails if received. Since 10 January 2026, about a million users have reportedly received password reset emails, prompting concern of a broader cyberattack.

Malwarebytes researchers found a sensitive database for sale on a cybercrime forum described as a doxxing kit affecting nearly 18 million Instagram users, with data potentially including home addresses linked to Instagram user IDs. Have I Been Pwned warned that a hacker shared a dataset of over 17 million records, including emails and other data allegedly scraped via an Instagram API, though there is no evidence that passwords or other sensitive data were compromised. The claims of a data breach persist in coverage, but Meta has insisted there was no breach and urged users to ignore the unsolicited emails.