Do Son 
A monumental data breach has compromised approximately 17.5 million Instagram users, resulting in the exfiltration of sensitive personal information that is now proliferating across the dark web. Analysts at Malwarebytes have corroborated the incident, underscoring profound anxieties regarding the sanctity of user privacy and account security.
The database, currently offered for sale on illicit marketplaces, encompasses usernames, email addresses, telephonic records, and partial physical addresses. This granular dataset renders victims exceedingly susceptible to identity theft, sophisticated phishing campaigns, and diverse manifestations of social engineering. Malwarebytes confirms that the cache is being actively traded on subterranean forums, accessible to malicious actors globally.
The repercussions have already manifested; a multitude of users have begun receiving authentic Instagram password reset notifications—a definitive harbinger that adversaries are leveraging the leaked data in attempts to hijack accounts. Experts caution that the exposure of associated emails and telephone numbers facilitates precision-targeted phishing, wherein provocateurs impersonate representatives from Instagram or Meta.
The purveyor of this data, operating under the pseudonym “Solonik,” asserts that the information was harvested during the waning months of 2024 via public APIs and regional sources. Advertisements surfacing in the dark web reveal samples containing names, telephone numbers, comprehensive email addresses, and partial geolocations of users spanning the globe. This evidence aligns with the warnings issued regarding the surge in unauthorized access attempts via password reset requests.
Users are urged to immediately activate two-factor authentication, transition to intricate and unique passkeys, and maintain a vigilant watch for suspicious correspondence, particularly missives masquerading as official communications from Instagram. Furthermore, it is advisable to audit authorized third-party applications and scrutinize active sessions to preclude unauthorized ingress.
Meta, has issued an official communique regarding the magnitude of the breach or the remedial measures being undertaken. The company posted on X that users can ignore the recent emails requesting password resets.
“We fixed an issue that let an external party request password reset emails for some people,” Instagram’s post on X read. “There was no breach of our systems and your Instagram accounts are secure.”
Related Posts:
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
