Instagram denies data breach following password reset alerts

Instagram has rejected claims that it suffered a data breach after a surge in password reset emails sparked concern among its global user base. The Meta-owned platform stated it had addressed a technical issue that allowed an external party to trigger legitimate reset requests, but insisted that accounts remained secure and that no internal systems were compromised.

However, in a post on X, cybersecurity firm Malwarebytes challenged the statement, claiming that a hack resulted in the theft of personal data from 17.5 million accounts. According to their report, sensitive information, including usernames, phone numbers, and physical addresses, is being offered for sale on a hacker forum. While some researchers believe this data is a compilation of publicly available information scraped in 2022, the source of the leak claims it is a more recent 2024 breach.

The discrepancy has understandably caused confusion among Instagram's user base, which has been further exacerbated by the platform's refusal to identify the party responsible for triggering the automated emails. Although the links within the emails appeared legitimate rather than malicious, Malwarebytes recommends that users enable two-factor authentication.

Training Announcement: Find out more about our range of independent accredited data protection and AI governance qualifications from IAPP and BCS.