Winning Bizness Desk
Mumbai.Personal data of more than 17.5 million Instagram users has reportedly been leaked and accessed by cyber criminals. According to a report by antivirus software firm Malwarebytes, the leaked information includes usernames, home addresses, phone numbers and email IDs. The company warned that this sensitive data is being sold on the dark web, increasing the risk of phishing attacks and account hacking for users across the world.
Leak linked to 2024 security lapse
Malwarebytes said the data leak was detected during its routine dark web monitoring. The firm linked the incident to a security lapse in Instagram’s API in 2024. An API is a system that allows different applications to communicate with each other. The company said such exposed data can be misused by cyber criminals to target users in multiple ways.
Hackers trying account access
According to Malwarebytes, after the data surfaced online, hackers began attempting to log into user accounts using leaked email addresses. The company cautioned that even partial personal details can be enough to trick users or bypass security checks. Experts said the leaked data may also be combined with information from other breaches to launch more effective attacks.
How leaked data can be misused
Cyber security experts warned that the leak is not limited to Instagram alone. The exposed credentials can be exploited in several ways, including:
- Phishing attempts through fake emails or messages
- Account takeover by gaining unauthorised access
- Credential stuffing if users reuse passwords on other platforms such as Facebook, Netflix or banking apps
India faces higher risk
India could be among the most affected countries. As per Statista, India had around 480 million Instagram users by October 2025, making it the platform’s largest user base. Facebook and WhatsApp also have over 500 million users each in the country, underlining Meta’s massive footprint. If Indian user data is part of the leaked dataset, the risk for local users could rise sharply.
Meta denies data breach claims
Meta has denied allegations of a data breach. A company spokesperson said a technical issue had allowed an external party to request password reset emails for some Instagram users, but the flaw was fixed. Meta maintained that there was no breach of its systems and that Instagram accounts remain secure.
However, experts advise users to stay cautious by changing passwords, enabling two-factor authentication, and avoiding suspicious links or messages to reduce potential damage from any leaked data.
