Instagram Denies Reports of Hacking and Data Breach, Says ‘Accounts Are Secure’

Instagram users received a brief scare last week after many received a password reset request on their registered email. A cybersecurity firm had claimed that this was done by a hacker group to break into the accounts of users to steal their data. It was also said that a large number of users' account data was stolen and was being sold on the dark web. However, on Sunday, the Meta-owned platform issued an official statement calling the reports of hacking and data breach false. It also claimed that no such attack occurred and that the user accounts remain secure.

Instagram Says No Data Breach Occurred

In a post on X (formerly known as Twitter), the official handle of Instagram said, “We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems, and your Instagram accounts are secure.” It also asked users to ignore any such emails.

The statement comes two days after Malwarebytes, a cybersecurity firm, posted on Bluesky that as many as 17.5 million Instagram accounts were compromised after a group of cybercriminals launched an attack on the social media platform. The post had claimed that bad actors were in possession of sensitive data, such as usernames, physical addresses, phone numbers, email addresses, and more. Additionally, it was also claimed that the “data is available for sale on the dark web and can be abused by cybercriminals.”

While the post did not reveal any evidence to suggest that user data was stolen or that it was being sold on the dark web, Instagram has also not elaborated on its statement to include any logs or activity data to confirm that a data breach did not occur. Additionally, Instagram did not share any details about the issue that allowed a third party to send a critical email about resetting account passwords.

As things stand, there is a lack of clarity on the series of events that took place. However, multiple users, including Gagdets 360 staff members, have confirmed receiving emails asking them to reset their passwords. If a user did click on the link to reset their password, it cannot be said for certain that their data was not compromised. We would recommend that any such users change their password via the app to ensure their data does not get into the hands of bad actors.