A massive digital archive containing the private information of approximately 17.5 million Instagram users appears to have fallen into the hands of cybercriminals.
A few hours ago, the alarm was raised after several Reddit users claimed to have received an email from Meta advising them to reset their password due to an alleged data breach. Unfortunately, these emails weren’t real, but merely scam attempts.
According to initial technical analysis by Malwarebytes, the stolen data package isn’t limited to simple, superficial identifiers. The database also includes usernames, email addresses, phone numbers, and even physical addresses . The availability of this comprehensive set of information exposes victims to the real risk of identity theft and targeted social engineering campaigns.
This archive appears to be actively circulating on dark web markets , becoming a bargaining chip for hackers and scammers. The repercussions are already visible: numerous users have reported receiving unsolicited password reset notifications. This phenomenon suggests that attackers are already attempting to break into accounts using the illicitly obtained credentials.
The combination of phone and email contacts opens the door to extremely sophisticated phishing attempts. Criminals can craft deceptive messages, seemingly from Instagram or its parent company Meta, to trick people into voluntarily handing over their login credentials.
At this time, neither Instagram nor Meta have released official statements clarifying the extent of the incident or providing reassurances about their security procedures. The mechanism behind the intrusion remains unclear: experts are evaluating whether the data was stolen through a direct vulnerability in the platform’s systems or whether the vulnerability was a third-party service connected to the social network.
While waiting for official announcements, experts advise taking preventive action. It’s a priority to enable two-factor authentication (2FA) and update your password with a complex combination never used on other portals. It’s also essential to be wary of any suspicious communications and constantly monitor active login sessions in your profile’s security settings.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
