Malwarebytes, a company specializing in cybersecurity software development, has reported a confirmed data leak affecting 17.5 million Instagram accounts.
The information collected as a result of the hacker attack is already being distributed for free on special forums, including BreachForums, where it was published on January 7, 2026, by an attacker operating under the pseudonym Solonik.
According to Cyberinsider, citing specialists from Malwarebytes, the source of the leak could be a vulnerability in the open API of Instagram that emerged in 2024. Although the exact vector of compromise has not yet been established, it is presumed that it could be either the API or a vulnerability in a third-party integrated service or an internal software error.
Malwarebytes warns that attackers are already using the stolen information—usernames, phone numbers, emails, and partially physical addresses—to conduct targeted attacks, such as sending phishing emails, as well as attempts to hack accounts through the password recovery mechanism. Some users whose data has been publicly exposed are already receiving notifications from Instagram about password reset requests.
Experts from Malwarebytes recommend that all Instagram users change their account passwords and enable two-factor authentication to enhance security.
Leave a comment