Instagram denies data leak following password reset email complaints

Instagram said accounts are safe after many users received unexpected password reset emails, following reports that raised concerns about a possible data leak

Many Instagram users around the world have recently reported receiving multiple password reset emails, even though they did not raised the request. According to a report by Engadgets, the sudden spike in these alerts caused concern about a possible data breach, prompting questions about whether user accounts had been compromised. Instagram has responded, saying user accounts remain secure and that there was no breach of its systems.

Instagram’s password reset email issue: Details 

According to the report, the issue first came into focus after an antivirus software company reported that data linked to around 17.5 million Instagram users was being circulated online. The information allegedly included usernames, email addresses, phone numbers and in some cases, physical addresses. The data was said to be available for sale on dark web forums, raising fears that it could be misused. 

 

Following this, many users began receiving repeated password reset emails from Instagram, which added to the confusion. The security report warned that such leaked information could potentially be used for phishing attacks, social engineering or attempts to take over accounts. It also suggested that the data may be connected to an earlier issue involving an Instagram API exposure from 2024., though no clear confirmation was provided. 

 

Instagram, however, has denied that any user data was breached.

 

In a post shared on X, the company said it had identified and fixed an issue that allowed an external party to trigger password reset emails for some users. It clarified that this did not involve unauthorised access to accounts or internal systems. According to Instagram, users who received these emails can safely ignore them.  

  Instagram posted, “We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion.”

While Instagram insists the incident was not a data breach, the situation has reportedly served as a reminder for users to review their account security. Enabling two-factor authentication, updating passwords regularly and checking which devices are logged into an account can help reduce risks. Users can review this information through the Accounts Center linked to their Instagram profile.