Data breach
Instagraminstagram.com
6 215 150 accounts exposed in a breach dated 2026-01-07.
Breached2026-01-07Added to HIBP2026-01-11 UTCUpdated by HIBP2026-01-11 UTCAccounts6 215 150Domaininstagram.com
Verified
What happened in Have I Been Pwned’s words
In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to password reset requests initiated on the platform, despite coinciding in timeframe. There is no evidence that passwords or other sensitive data were compromised.
Exposed data as HIBP classifies it
- Display names
- Email addresses
- Geographic locations
- Phone numbers
- Usernames
How HIBP qualifies it
- HIBP verified that the data came from this service.
Source: Have I Been Pwned (CC BY 4.0)
Copied from HIBP 2026-11-05 03:50 UTC