Instagram Data Breach Data Breach

In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform, despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.

What Happened

In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform, despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.

What Data Was Exposed

Who Is Affected

Anyone who had an account with Instagram before January 2026 may be affected. The breach exposed 6.2 million records.

How to Check If You Were Affected

Visit haveibeenpwned.com and enter your email address to check if you were included in this breach.

What You Should Do Now

1. Watch for phishing emails. Scammers may use your leaked email to send targeted phishing attempts. Be extra cautious of unexpected emails.
2. Be wary of suspicious calls/texts. Your phone number may be used for smishing or vishing attacks.
3. Enable two-factor authentication. Add 2FA to your accounts wherever possible for extra security.
4. Consider identity monitoring. A monitoring service can alert you to suspicious activity.

Last updated: January 20, 2026