Merve Berker
January 11, 2026•Update: January 12, 2026
ANKARA
Personal data from at least 17.5 million Instagram users has reportedly been leaked and shared on the dark web, raising serious concerns about user privacy and platform security, media reports said on Saturday.
The cybersecurity firm Malwarebytes said that the leaked dataset includes user names, full names, email addresses, phone numbers, partial physical addresses, and other contact information, according to Daily Mail.
While no passwords were included, experts warn that the compromised data can still be used for identity theft or financial fraud.
The breach was first traced to a 2024 vulnerability in Instagram's API, according to cybersecurity publication CyberInsider.
Hackers reportedly bypassed Meta's standard protections and scraped sensitive data before a threat actor identified as “Solonnik” published the records on BreachForums earlier this week, offering the dataset for free.
“Such a massive leak significantly increases the risk of phishing campaigns and targeted fraud,” experts told Malwarebytes, the outlet noted.
Following the breach, users across several regions reported receiving an unusual volume of password reset emails, fueling fears of compromised accounts.
US company Meta, which owns the social media platform Instagram, has not issued a public statement confirming the breach as of early January.
Instagram’s official help pages note that receiving a password reset email does not necessarily indicate a hack, but cybersecurity analysts suggest users take caution.
The leaked data reportedly affects Instagram accounts globally and includes both personal and influencer profiles.
The incident comes amid increasing scrutiny of social media companies’ data protection practices.
