Instagram Breach

In 2024 a dataset of roughly 17 million Instagram records surfaced after what appeared to be an exposed third party data broker, built largely from automated scraping rather than a confirmed compromise of Meta’s systems. It contained a broad range of personal data - usernames, emails, phone numbers, profile links and in some cases passwords - making it highly useful for fraud and phishing. The material first circulated on BreachForums in 2024 and was rapidly copied, segmented, and folded into other underground collections.

The versions now circulating in 2026 closely resemble that earlier release, even as some media and alerting services such as Have I Been Pwned have referred to them as new, adding to the uncertainty. Many analysts believe the bulk of the data is likely older and being redistributed in modified form, a familiar pattern in breach markets where rebranding can be mistaken for novelty.