Instagram data breach reportedly exposed the personal info of 17.5M users • Hacker News Board

Re: Instagram data breach reportedly exposed the personal info of 17.5M users

#61

Post by ares623 » Sun, Jan 11, 2026, 9:52 PM UTC

chneu wrote: post #16

HelloUsername wrote: post #13

Source posted on 9-jan: https://news.ycombinator.com/item?id=46571968 Instagram response posted on 11-jan: " We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion " https://xcancel.com/instagram/status/2010202301886238822?s=2...

I get email reset passwords from IG at least once a month. I doubt they fixed anything. Lol

I’m 100% convinced they send those out purposefully to encourage users to log back in.

Re: Instagram data breach reportedly exposed the personal info of 17.5M users

#62

Post by fn-mote » Sun, Jan 11, 2026, 11:41 PM UTC

malshe wrote: post #44

HelloUsername wrote: post #13

Source posted on 9-jan: https://news.ycombinator.com/item?id=46571968 Instagram response posted on 11-jan: " We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion " https://xcancel.com/instagram/status/2010202301886238822?s=2...

I received a password reset request email just yesterday. Not sure what they fixed.

I’m confident that is the breach/attack/whatever they are discussing.

Re: Instagram data breach reportedly exposed the personal info of 17.5M users

#63

Post by Anamon » Mon, Jan 12, 2026, 1:40 AM UTC

cheald wrote: post #60

I receive several "Let's help get you back onto Instagram" emails a week, and have for months and months. I can only assume it's someone trying to do something nasty, but I have no idea what it actually could be. It's quite perplexed me.

Someone seems to be running a campaign like this with Amazon accounts currently. I don't know the password reset process for Instagram, but maybe a similar thing could be happening that people assumed is behind the Amazon wave:

Amazon sends you a 6-digit code to reset your password. The code is valid for five minutes before a new one is generated. I don't know what the rate limit is, but even if you can just try five times within those five minutes, your chance of guessing it right would be 1 in 200,000. Now assume the attackers are running this on several million accounts in parallel, and you can assume they'd be able to steal a few accounts just with lucky guesses.

It worried me enough that I removed my phone number from my account, through which the password reset requests were initiated. The absolute risk for each user may be low, but overall it seems like a terrible system with regards to security.