Instagram data breach reportedly exposed the personal info of 17.5M users

Post by varenc » Sun, Jan 11, 2026, 5:44 PM UTC

chneu wrote: post #16

HelloUsername wrote: post #13

Source posted on 9-jan: https://news.ycombinator.com/item?id=46571968 Instagram response posted on 11-jan: " We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion " https://xcancel.com/instagram/status/2010202301886238822?s=2...

I get email reset passwords from IG at least once a month. I doubt they fixed anything. Lol

Post by netsharc » Sun, Jan 11, 2026, 5:51 PM UTC

salgorithm wrote: post #27

paxys wrote: post #15

Am I missing something? The source they shared is a screenshot of a password reset email, which anyone can trigger if they have the email address of the account.

I have a masked email* for Instagram and have received two password reset requests in the last five days. Obviously, this is just an anecdote. * https://support.1password.com/fastmail/

Post by faust201 » Sun, Jan 11, 2026, 6:08 PM UTC

ivan_gammel wrote: post #32

pentagrama wrote: post #28

I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…

If mailboxes of some people were breached, those reset emails can be used to steal their Instagram accounts. So it can be some other breach being exploited, rather than a vulnerability in Instagram account itself.

Post by ipaddr » Sun, Jan 11, 2026, 6:45 PM UTC

Fire-Dragon-DoL wrote: post #39

gloxkiqcza wrote: post #34

Earlier quoted context omitted.

Password reset emails usually contain a token that expires rather quickly so unless I’m missing something, this should be a non-issue.

But you can generate such emails with a public username

Post by SkyPuncher » Sun, Jan 11, 2026, 7:00 PM UTC

Fire-Dragon-DoL wrote: post #39

gloxkiqcza wrote: post #34

Earlier quoted context omitted.

Password reset emails usually contain a token that expires rather quickly so unless I’m missing something, this should be a non-issue.

But you can generate such emails with a public username