In recent days, numerous Instagram users have been receiving a suspicious email asking them to reset their passwords. The email states that Instagram has received a request for a password reset. While many users have (rightly) ignored the email, some feared that it could be a phishing attempt by malicious attackers. However, as it turns out, the request from Instagram was genuine. Various sites, such as BleepingComputer , subsequently reported that there had been a major data leak in which attackers were able to access the user data of approximately 17 million Instagram accounts. At least, that’s what was claimed in certain forums. The leaked data set is said to contain the usernames and IDs of approximately 17 million accounts. In addition, there are 12 million real names, 6 million email addresses, and 3 million phone numbers. Passwords are not said to appear in the data set. Instagram denies the data leak Shortly afterwards, Instagram itself issued a statement. A spokesperson told BleepingComputer that there had indeed been a technical problem that made it possible for external sources to send password reset emails. However, Instagram said there was no data leaked this way. Instagram also assured users that there was no cause for concern. They should simply ignore the emails and no further action is necessary. We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion. — Instagram (@instagram) January 11, 2026 Where did the data come from? If the data leak didn’t originate from this recent incident, a legitimate question arises: where could the leaked data set have come from? Experts assume the user data was taken from another leak in 2024. Others, however, claim that the data leak dates back to 2022. Instagram has not confirmed the existence of either incident. The last officially confirmed Instagram leak dates back to 2017. Meanwhile, security researcher Troy Hunt reports via Have I Been Pwned that 6 million email addresses from Instagram accounts have been leaked. Hunt is considered a reliable source when it comes to data breaches, so it appears the leaked data could indeed have originated from the recent Instagram incident. What you should do now If you’ve received an unexpected password reset email from Instagram, there’s no need to worry about your account possibly being hacked. As mentioned above, no passwords were leaked. However, you should remain extra vigilant about phishing attacks and check whether your email address was included in a recent HIBP report . If you haven’t already done so, activate two-factor authentication on your Instagram account to boost its security and make it harder for hackers to gain access to your account. Learn more about protecting your accounts with two-factor authentication .