This would be monumental if true, meta data breaches are basically unheard of contrary to popular opinion
Instagram data breach reportedly exposed the personal info of 17.5M users
51–60 of 63 posts
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#52Source posted on 9-jan: https://news.ycombinator.com/item?id=46571968 Instagram response posted on 11-jan: " We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion " https://xcancel.com/instagram/status/2010202301886238822?s=2...
I get email reset passwords from IG at least once a month. I doubt they fixed anything. Lol
I mean, if they knew who was requesting the password reset, then you wouldn’t need to reset the password, just accept whatever auth mechanism allows them to know who is resetting the password.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#53Source posted on 9-jan: https://news.ycombinator.com/item?id=46571968 Instagram response posted on 11-jan: " We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion " https://xcancel.com/instagram/status/2010202301886238822?s=2...
I get email reset passwords from IG at least once a month. I doubt they fixed anything. Lol
Yep I got 2 on Jan 9th. he e-mails come from security@mail.instagram.com
I also get a bunch of these e-mails from them every few weeks:
Sorry to hear you’re having trouble logging into Instagram. We got a message that you forgot your password. If this was you, you can get right back into your account or reset your password now.
So, I guess you can actually message them, pretend to another user to rese password? I don't follow many people or have many followers. I can't imagine the attempts on other higher valued accounts...
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#54I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…
My Instagram username is and I get password reset offers (they say “looks like you’re having trouble logging into Instagram” or something similar) about once a week.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#55I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…
> From an attacker’s perspective, this does not grant access to accounts or sensitive data
I think there might be an effort in the "security" snake oil industry to classify publicly available data as some sort of breach. Probably because for a security company it's a quick win finding such a "breach" you can generate publicity with and/or scare clueless executives into buying your solution/consultancy services. I think there was a similar "breach" at Twitter where it turns out it was all publicly-available data users themselves put on their public profile that was scraped.
I've personally had people argue with me that disclosing whether an account was registered was a major breach and do "something" about it, yet refuse to change the registration form to also not disclose that fact (since otherwise we'd have to move the registration process behind an emailed link and ask the user to wait for the confirmation email to continue, killing conversion rates).
The "something" was done, and of course the bad guys promptly moved onto the signup form. But hey as far as I know, we're now secure™.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#56I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…
My Instagram username is and I get password reset offers (they say “looks like you’re having trouble logging into Instagram” or something similar) about once a week.
Same, on average. I'll go a few weeks without any, then one or two per day for a while.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#57Earlier quoted context omitted.
Most people are incredible naive and willingly provide that information to Facebook/Meta. They even provide real names and videos and pictures of themselves and their relatives to these websites!
Sometimes Meta decides you are not real or your name is not real and block your account. They will ask for a ID, then a video, then an ID, then a photo, then an ID, ... After an undefined number of iterations, they made decide you are real enough, until ...
> block your account.
I would consider this as a favor.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#58I looked into this a bit and I am also skeptical about the leak narrative. I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy. At scale you would need IP rotation and some basic automation, but it is not particularly hard to generate a…
Skeptical? There's not even a clear claim of what the leaked information is? There just appears to be no leak at all.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#59Am I missing something? The source they shared is a screenshot of a password reset email, which anyone can trigger if they have the email address of the account.
You don't even need the email address. The account name is enough to start the password request.
Re: Instagram data breach reportedly exposed the personal info of 17.5M users
#60I receive several "Let's help get you back onto Instagram" emails a week, and have for months and months. I can only assume it's someone trying to do something nasty, but I have no idea what it actually could be.
It's quite perplexed me.