17.5 Million Instagram Accounts Stolen? Company Denies Breach As Data Claims Circulate

A cybersecurity firm claims 17.5 million Instagram accounts were stolen and sold online—despite the company's denial of any breach.

Malwarebytes alleged that cybercriminals had accessed sensitive data from 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, and email addresses.

The firm shared this claim via a Bluesky post, citing evidence of the data being available for purchase on the dark web. The statement reads:

"Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more."

Instagram responded to the allegations via X (formerly Twitter), stating there had been no breach.

The company said users could "ignore those emails — sorry for any confusion" and confirmed it had "fixed an issue that let an external party request password reset emails for some people." Notably, Instagram did not address the specific claims about data being sold on the dark web or provide a detailed explanation of the "fixed issue."

For small business owners using Instagram for marketing, verifying account security requires proactive steps. Enabling two-factor authentication (2FA) adds a critical layer of protection against unauthorized access. Users should also review login activity for suspicious devices or locations and ensure all linked email addresses are secure.

The lack of transparency from Instagram contrasts sharply with Malwarebytes' detailed allegations, leaving users to navigate the uncertainty with limited guidance from the platform itself.