Instagram data breach reportedly exposed the personal info of 17.5M users

Post by ivan_gammel » Sun, Jan 11, 2026, 4:57 PM UTC

pentagrama wrote: post #28

I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…

Post by gloxkiqcza » Sun, Jan 11, 2026, 5:10 PM UTC

ivan_gammel wrote: post #32

pentagrama wrote: post #28

I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…

If mailboxes of some people were breached, those reset emails can be used to steal their Instagram accounts. So it can be some other breach being exploited, rather than a vulnerability in Instagram account itself.

Post by adventured » Sun, Jan 11, 2026, 5:22 PM UTC

staindk wrote: post #35

chneu wrote: post #16

Earlier quoted context omitted.

I get email reset passwords from IG at least once a month. I doubt they fixed anything. Lol

Same, it's very weird. Only ever IG. Got one a day or two ago again actually.

Post by Ekaros » Sun, Jan 11, 2026, 5:25 PM UTC

chneu wrote: post #16

HelloUsername wrote: post #13

Source posted on 9-jan: https://news.ycombinator.com/item?id=46571968 Instagram response posted on 11-jan: " We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion " https://xcancel.com/instagram/status/2010202301886238822?s=2...

I get email reset passwords from IG at least once a month. I doubt they fixed anything. Lol

Post by stackghost » Sun, Jan 11, 2026, 5:36 PM UTC

ivan_gammel wrote: post #32

pentagrama wrote: post #28

I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…

If mailboxes of some people were breached, those reset emails can be used to steal their Instagram accounts. So it can be some other breach being exploited, rather than a vulnerability in Instagram account itself.