Instagram data breach: 6.2M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-01-11
In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform, despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised. Exposed data: display names, email addresses, geographic locations, phone numbers, usernames. The breach dates from Jan 7, 2026; Have I Been Pwned loaded it on Jan 11, 2026.
What to do
- If you had a Instagram account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
