Instagram 2026 Data Breach Claim
The Instagram-associated January 2026 dataset consists of profile and contact information reportedly posted to an underground forum under a “2024 API leak” label.
Exposed Data Types
6- Display names
- Email addresses
- Geographic locations
- Phone numbers
- User IDs
- Usernames
About This Breach
A verified breach index reports 6,215,150 unique email addresses in the attributed dataset and says a broader set contained about 17 million rows of public Instagram information. Although the data was alleged to have been scraped through an API, this evidence does not establish an intrusion into Instagram's systems, the collection method, or the claimed 2024 date.
The supported scope includes display names, usernames, user IDs, email addresses, countries or partial location information, and phone numbers in some records. Passwords, private messages, session tokens, payment data, and private-profile content are not confirmed fields. The 6,215,150 value represents unique email identifiers, not unique people, active Instagram accounts, or all 17 million rows. Production has no local import job or searchable person-level dataset linked to this event.
Password-reset emails are a separate event
Around the time the dataset appeared, some users received password-reset emails they had not requested. Instagram said it fixed an issue that allowed an external party to request reset emails for some people, that there was no breach of its systems, and that accounts were secure. An independent security review said the timing was suspicious but found no clear connection between the reset requests and the forum dataset. The platform statement concerns the reset-email issue and does not by itself explain the dataset's origin; the two events are not merged.
Privacy and security boundary
An email, phone, or profile match does not prove a legal identity, precise location, current account ownership, private account activity, or account takeover. Matching public profile fields with direct contact details can nevertheless make fake support, copyright, brand-collaboration, or account-verification messages more convincing. The presence of a phone number may make carrier-themed or verification-code scams easier to target, but it does not show that a SIM swap occurred.
Safe next steps
Do not use a link in an unexpected password-reset email; if an account check is needed, open the Instagram app or a previously known official address directly. Unfamiliar sessions and linked contact details can be reviewed, and a unique password plus authenticator-app or security-key multifactor authentication can be used. Because no password is confirmed in this dataset, a match alone must not be treated as evidence that a password leaked or an account was taken over.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
