Meta denies data breach of 17.5 million users; asks users to ignore password reset emails

Meta’s Instagram has dismissed concerns about a data breach of its users in a post on X on Sunday. The platform clarified that there was an issue with an external entity sending requests to users to reset their passwords without confirming the number of accounts receiving such emails.

“We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion,” Instagram wrote in a post on X on Sunday.




This clarification comes as users around the world reported having received emails to reset their passwords, raising concerns about a possible data breach.

The issue was brought to attention in a recent post by Malwarebytes, a software company, on the microblogging platform Bluesky, which claimed that sensitive information of over 17.5 million users was stolen and made available for sale on the dark web.

“Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more. This data is available for sale on the dark web and can be abused by cybercriminals,” the company wrote in a post on Friday.

Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more. This data is available for sale on the dark web and can be abused by cybercriminals.

[image or embed]

— Malwarebytes (@malwarebytes.com) 9 January 2026 at 22:04

This is, however, not the first time that data breach concerns have been raised regarding Meta’s family of apps. In 2021, Facebook reported that data relating to over 530 million users had been exposed. The company maintained that the incident was not a breach but the result of information scraped from publicly accessible profiles. Data breach incidents have also affected other major social media platforms. X and LinkedIn, for instance, reported similar breaches in 2018 and 2021, collectively impacting billions of users.