[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqmm6ngxz6l81":3},{"success":4,"breach":5},true,{"_id":6,"name":7,"title":8,"slug":7,"domain":9,"breachDate":10,"addedDate":11,"publishedAt":12,"modifiedDate":13,"contentUpdatedAt":13,"source":14,"sourceUrl":15,"sourceUrls":16,"pwnCount":18,"affectedCount":18,"affectedCountStatus":19,"affectedCountLowerBound":12,"affectedCountUnit":20,"hasEnglishDescription":4,"contentLocale":21,"availableLocales":22,"translations":24,"severity":27,"dataClasses":28,"description":35,"seoTitle":36,"seoDescription":37,"logoUrl":38,"isVerified":4,"isSensitive":39,"isSpamList":39,"isMalware":39,"company":40},"6a452308a20f867c8ba8e71e","instagram","Instagram 2026 Data Breach Claim","instagram.com","2026-01-07T00:00:00.000Z","2026-01-11T16:59:02.000Z",null,"2026-07-29T15:45:51.001Z","Authenticated attributed corpus, independent security reporting, and official platform statement","https:\u002F\u002Fwww.malwarebytes.com\u002Fblog\u002Fnews\u002F2026\u002F01\u002Freceived-an-instagram-password-reset-email-heres-what-you-need-to-know",[15,17],"https:\u002F\u002Fx.com\u002Finstagram\u002Fstatus\u002F2010202301886238822",6215150,"known","email_identifiers","en",[21,23],"tr",{"en":25,"tr":26},{"slug":7},{"slug":7},"Critical",[29,30,31,32,33,34],"Display names","Email addresses","Geographic locations","Phone numbers","User IDs","Usernames","\u003Cp>\u003Cstrong>The Instagram-associated January 2026 dataset\u003C\u002Fstrong> consists of profile and contact information reportedly posted to an underground forum under a “2024 API leak” label. A verified breach index reports 6,215,150 unique email addresses in the attributed corpus and says a broader set contained about 17 million rows of public Instagram information. Although the data was alleged to have been scraped through an API, this evidence does not establish an intrusion into Instagram's systems, the collection method, or the claimed 2024 date.\u003C\u002Fp>\n\n\u003Cp>The supported scope includes display names, usernames, user IDs, email addresses, countries or partial location information, and phone numbers in some records. Passwords, private messages, session tokens, payment data, and private-profile content are not confirmed fields. The 6,215,150 value represents unique email identifiers, not unique people, active Instagram accounts, or all 17 million rows. Production has no local import job or searchable person-level corpus linked to this event.\u003C\u002Fp>\n\n\u003Ch2>Password-reset emails are a separate event\u003C\u002Fh2>\n\u003Cp>Around the time the dataset appeared, some users received password-reset emails they had not requested. Instagram said it fixed an issue that allowed an external party to request reset emails for some people, that there was no breach of its systems, and that accounts were secure. An independent security review said the timing was suspicious but found no clear connection between the reset requests and the forum dataset. The platform statement concerns the reset-email issue and does not by itself explain the dataset's origin; the two events are not merged.\u003C\u002Fp>\n\n\u003Ch2>Privacy and security boundary\u003C\u002Fh2>\n\u003Cp>An email, phone, or profile match does not prove a legal identity, precise location, current account ownership, private account activity, or account takeover. Matching public profile fields with direct contact details can nevertheless make fake support, copyright, brand-collaboration, or account-verification messages more convincing. The presence of a phone number may make carrier-themed or verification-code scams easier to target, but it does not show that a SIM swap occurred.\u003C\u002Fp>\n\n\u003Ch2>Safe next steps\u003C\u002Fh2>\n\u003Cp>Do not use a link in an unexpected password-reset email; if an account check is needed, open the Instagram app or a previously known official address directly. Unfamiliar sessions and linked contact details can be reviewed, and a unique password plus authenticator-app or security-key multifactor authentication can be used. Because no password is confirmed in this dataset, a match alone must not be treated as evidence that a password leaked or an account was taken over.\u003C\u002Fp>","Instagram 2026 Data Breach Claim (6.2 Million Email Identifiers)","The Instagram-attributed 2026 dataset contains 6,215,150 unique emails. Review the limits around system intrusion, passwords, and reset emails.","\u002Fuploads\u002Flogo\u002Finstagram_com.webp",false,{"name":41,"sector":42,"country":43,"website":9,"websiteArchiveUrl":44,"websiteStatus":44,"websiteCheckedAt":12},"Instagram","Social Media","United States",""]