Hackers Begin Mass Hacking of Instagram Accounts Following Major Data Leak
Users worldwide are receiving notifications about hacks.
Users worldwide are receiving notifications about hacks.
A major data leak has affected approximately 17.5 million Instagram users — personal information has been leaked online and is already actively circulating on the dark web. This was reported by specialists from Malwarebytes, who emphasized that the situation raises serious concerns about account privacy and security.
The database, which has been put up for sale, includes usernames, email addresses, phone numbers, and partially physical addresses. Such a dataset makes victims extremely vulnerable to identity theft, phishing, and other forms of social engineering. Malwarebytes confirms that the database is actively being traded on underground platforms and is available to malicious actors worldwide.
The consequences are already being felt: many users have begun receiving legitimate Instagram password reset notifications — a clear sign that attackers are attempting to hijack their accounts using the leaked data. Experts warn that knowledge of the email and phone number associated with an account paves the way for targeted phishing attacks, where criminals impersonate Instagram or Meta* representatives.
The seller, operating under the nickname Subkek, claims to have collected the information in recent months of 2024 using public APIs and regional sources. Listings published on the dark web show sample records containing names, phone numbers, full email addresses, and partial geolocation data of users worldwide. This aligns with Malwarebytes' warning about a wave of attempted password hijacking via access resets.
Users are advised to immediately enable two-factor authentication, change their passwords to strong and unique ones, and closely monitor suspicious emails or messages, especially those purportedly coming from Instagram. It is also worth checking the list of connected applications and active sessions to rule out unauthorized access.
Instagram and its parent company Meta* have not yet released official statements regarding the scale of the leak and the measures being taken. Cybersecurity experts continue to investigate, attempting to determine whether the incident is related to a vulnerability in the platform itself or an external service.
