two different versions, millions of accounts in check and one good idea
If you’ve received a message from Instagram asking you to reset your password in the last few days, you’re not the only one. A quick look to Reddit or social networks like X/Twitter evidence that it is something quite common at the beginning of 2026. In fact, there are those who assures have received these messages on several occasions this week, including a few times a day. what has happened. Numerous Instagram users have detected unusual activity related to mass password reset requests. More specifically, they were receiving password reset emails that looked legitimate without having requested it first. Two versions that explain it. Following that massive request and speculation, on January 9, the antivirus software company Malwarebytes made public a data leak. Just a few hours ago, Instagram pronounced. The versions of each one: According to Malwarebytes, a group of cybercriminals “stole sensitive information from 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses and more.” It is not mere scraping, but an authentic doxing kit found on a popular cybercrime forum. From here, there were two options: either we were facing an automated brute force attack where legitimate “I forgot my password” emails were generated and, within the chaos, a malicious email was sent so that you click on a false link. Or that Meta had executed a defensive Instagram reset of those accounts it considers compromised. According to Instagram, they have fixed an issue that “allowed a third party to request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure.” He closed the explanation with an apology for the inconvenience. Tap to go to the post Why is it important. Instagram minimizes the impact of this incident by calling it a “software problem” and not a systems breach since technically, if they did not enter their servers, they do not consider it a hack. In any case, this alleged data leak contains usernames, real names, physical addresses, phone numbers, and email addresses. The level of risk is high insofar as this exposure of confidential personal information is of such caliber that it breaks the barrier between the digital and the physical. Exposing who you are online also jeopardizes real-world security. The reports detail that parts of that database are being marketed on the black market, sorting them into batches based on countries and numbers of followers. That is, prioritizing high-profile accounts such as influencers or business accounts. What should you do now. To begin with, under no circumstances touch on the links that appear in the emails, no matter how real they may seem. From here: Change Instagram password from the app, in ‘Settings and activity’ > ‘Account Center’ > ‘Password and security’ > ‘Change password’. Use a long, robust and unique one. Configure the Two-Step Authentication that you will find in the ‘Password and Security’ section of the app, following the previous route. Better avoid the SMS option. Likewise, it is advisable to log out on all devices and, in case you have received several messages, check if the emails are truly from Instagram through the ‘Emails from Instagram’ option in the settings. If you detect any, delete them. In Xataka | “You can’t trust your eyes to know what’s real anymore.” Instagram CEO announces that the feed is dead In Xataka | Instagram has wreaked havoc on tourism in half the world. AI has arrived to multiply it by a thousand Cover | Solen Feyissa and Gemini