Massive Risks: How 17.5 Million Instagram Users Were Exposed on the Dark Web

If you are an Instagram user, there is concerning news you need to know. A colossal data leak affecting 17.5 million accounts has reappeared on dark web underground forums during January 2026, sparking a new wave of cybersecurity threats. Malwarebytes experts have detected the circulation of sensitive information including usernames, email addresses, phone numbers, and personal metadata on platforms like Breachforums.

The origin of the breach: a misconfiguration that changed everything

The root of the problem dates back to a critical flaw in Instagram’s API during 2024. A misconfiguration allowed attackers to mass extract user profile information without authorization. The worrying part is that, although Meta discovered the issue long ago, the recent reappearance of this data on the dark web has multiplied current threats.

How cybercriminals exploit your data

Attackers are cleverly leveraging the leak. They use the extracted phone numbers and emails to run massive phishing campaigns, sending fake password reset requests that perfectly mimic legitimate Instagram systems. This has caused an explosive increase in unsolicited emails, aiming to deceive unsuspecting users.

Measures you should take now

Malwarebytes issues urgent recommendations:

• Change your Instagram password immediately
• Enable two-factor authentication on your account
• Be skeptical of password reset emails
• Verify directly from the official app before clicking links

Meta remains silent regarding this reappearance of data on the dark web, but users cannot wait. The spread of this information in clandestine spaces demands urgent defensive actions to protect your privacy.