Millions of Instagram account details 'leaked' as users asked to reset passwords

Users have been warned not to click or respond

Millions of Instagram users are receiving unexpected password reset emails after reportedly having their account details leaked.

Instagram has since attempted to reassure its users by denying the data of more than 17 million users had fallen into the wrong hands and insisted there had been no breach.

Users of the social media platform have reportedly been warned they should be cautious before clicking or responding.

Experts say that while users should avoid clicking the Reset Password button in suspicious emails, attackers would still need additional information to successfully access accounts.

Davey Winder, a Forbes and cybersecurity writer said he was among those who received a 'legitimate-looking email' on Friday, 'seemingly from Instagram', claiming the company had received a request to reset his account password.

The email included a big, blue Reset Password button, along with the message, “If you ignore this message, your password will not be changed. If you didn't request a password reset, let us know," according to the Independent.

Sensitive data from over 17 million Instagram records had reportedly been leaked online by a threat actor known as "Solonnik." According to the tech publication CyberInsider, the data was originally stolen during an API leak in 2024, where a hacker bypassed standard security protections to scrape the information.

It was claimed the massive dataset was published for free on the popular cybercrime site BreachForums, according to reports.

Writing on X on Sunday morning, Instagram advised: "We fixed an issue that let an external party request password reset emails for some people.

"There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails - sorry for any confusion."