Instagram Data Leak Hits 17.5 Million Users

Millions of Instagram users worldwide have been affected by a major data leak exposing personal details of approximately 17.5 million accounts, prompting a surge in suspicious password reset emails that cybersecurity experts link to cybercriminals exploiting the breach.

The incident came to light this week when a threat actor using the alias Solonnik posted the dataset on the hacking forum BreachForums on Wednesday. The records, stolen through an API vulnerability earlier in 2024, include usernames, full names, email addresses, phone numbers, user IDs, country information, and partial physical addresses. Security firm Malwarebytes first alerted the public to the leak on Saturday after detecting it during a routine dark web scan, noting that the data is now circulating among cybercriminals and could fuel identity fraud, phishing attacks, or account takeovers.

Users began reporting a flood of unsolicited password reset notifications shortly after the data surfaced. Davey Winder, a cybersecurity analyst and contributor to Forbes, said he received a dozen such emails over 48 hours starting Friday. "I was among those who received a legitimate-looking email seemingly from Instagram,...