Instagram: a data breach
In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum . The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform , despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.
The record
- Organisation
- Instagram →
- Identity
- Instagramidentified by its domain in a verified breach record
- Records affected
- 6,215,150 records
- Data exposed
- Display names, Email addresses, Geographic locations, Phone numbers, Usernames
- Sector
- Not recorded
- Occurred
- 2026-01-07
- Disclosed
- 2026-01-11
- First recorded here
- 2026-09-09
Fastnexa security experts
Worried the same could happen to your company?
If you are a customer or supplier of Instagram, or work in the same industry, a Fastnexa security expert can tell you what this means for your data and test whether the same attack would work on you.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Sources (1)
One source so far.
- Have I Been Pwned ↗First reported
2026-01-11