Instagram data breach 2026: what happened and what to do

What happened

In January 2026, a data set of Instagram user records was shared online. Have I Been Pwned (HIBP) dates it to 7 January 2026, added it on 11 January 2026 and lists 6,215,150 affected accounts. HIBP's entry says the data was alleged to have been scraped through an Instagram API.

Scraping means collecting data in bulk from a service's own interfaces, without breaking into the servers behind them. That's why the Instagram story is awkward. Meta said it hadn't suffered a breach. At the same time, many Instagram users got unexpected password reset emails. Meta said it fixed an issue that let an outside party request password reset emails for some users, that accounts remained secure, and that people could ignore those emails.

So two separate things were in the news at once. A password reset flaw that Meta fixed, and a scraped data set that HIBP added. Don't assume that one caused the other.

What was exposed

HIBP lists five types of data: usernames, display names, email addresses, phone numbers and geographic locations. It does not list passwords. A different data set, reported by another security firm as being sold on a crime forum, was said to include home addresses. That's a separate claim and isn't part of the HIBP entry.

Scraped data is mostly information that was reachable through the app. The harm comes from joining it up. An email and a phone number tied to a username and a location turns a public profile into a contact record.

What criminals can do with it

The likeliest result is scams that use your handle. Expect messages that mention Instagram, say your account has been flagged for a policy violation, or offer to "verify" it for a fee. The reset emails made this easier, because people now expect odd mail from Instagram.

The phone number matters most. It lets someone text you directly, and it's the number a criminal needs for a SIM swap attempt against a phone that's also your second login factor. If your Instagram account is how people find your business, the same goes for impersonation.

The company's response

Meta said it had fixed the reset issue and denied any breach of its systems. It told people they could disregard the reset emails. If you want to check your account, open Instagram's settings, review the devices that are logged in and log out any you don't recognize.

A note on scraped data

Services often don't count scraping as a breach, and users still suffer the same effects. The question to ask isn't whether the company was hacked. It's whether your email and phone number are now sitting in a list. If they are, act as you would after any other breach.