Cybercriminals stole the sensitive data of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more. This data is available for sale on the dark web and can be abused by cybercriminals.
– Malwarebytes (@malwarebytes.com) January 9, 2026 at 8:34 AM
A meaningful data breach impacting 17.5 million Instagram users has surfaced, with sensitive personal information now being traded on the dark web. This incident underscores the ever-present risks associated with online data security and the importance of proactive measures to protect your digital life. As of January 11, 2026, the compromised data includes usernames, home addresses, phone numbers, and email addresses – details that can fuel a range of malicious activities.
Understanding the Instagram Data Breach
Recent reports indicate that cybersecurity firm Malwarebytes discovered the sale of this extensive dataset on illicit online marketplaces.I’ve found that these dark web marketplaces are constantly monitored by security firms, but the sheer volume of data now available is concerning. The breach is believed to stem from an Submission Programming Interface (API) vulnerability exploited in 2024, allowing unauthorized access to user information. This isn’t simply a matter of leaked passwords; it’s a complete exposure of personal details.
Have you noticed any unusual activity on your Instagram account, such as unexpected password reset requests? Many users are reporting just that, as evidenced by discussions on platforms like Reddit here. These requests could be an early sign that your information is being targeted.
According to a recent report by Statista, data breaches increased by 78% in the first half of 2025 compared to the same period in 2024, highlighting a growing trend of cyberattacks. This emphasizes the need for heightened vigilance and robust security practices.
What Information Was Compromised?
The scope of this Instagram data leak is particularly alarming because of the types of data exposed. It goes far beyond basic account credentials. Here’s a breakdown of the information now in the hands of cybercriminals:
- Usernames: Your public-facing identifier on the platform.
- Physical Addresses: Potentially exposing your home or work location.
- Phone Numbers: Opening the door to SMS phishing and other scams.
- Email Addresses: Leading to targeted phishing campaigns and spam.
This combination of data allows attackers to build detailed profiles of individuals, making them vulnerable to elegant social engineering attacks.