The cybersecurity company Malwarebytes just noticed something unpleasant happening over on the dark web:
Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more. This data is available for sale on the dark web and can be abused by cybercriminals.
[image or embed]
— Malwarebytes (@malwarebytes.com) January 9, 2026 at 8:34 AM
Did you receive any unexpected password reset emails from Instagram lately? If the comments on a Reddit post about this breach from a few hours ago are any indication, you’re not alone.
It seems that the physical addresses, phone numbers, email addresses and other information attached to the accounts of 17.5 million Instagram users is available for sale in the sketchier parts of the internet.
Apparently Malwarebytes performs sweeps of the dark net for items like this, and surmised that this cache of personal details is tied a 2024 API breach that likely allowed an attacker to pry the information out of Instagram.
Some steps you can take to ensure that your information is safe include:
- Resetting your password right now
- Turning on two-factor authentication if you haven’t already
- Permanently deleting all social media accounts from all platforms
So far Instagram does not appear to have published a statement about this issue. Gizmodo reached out to Meta for comment, and will update if we hear back.Â
