If you were concerned about your Instagram account over the weekend, you were certainly not alone. Many Instagram users received an email telling them that they needed to reset their account password, and this was quickly linked to a data breach from 2024 affecting 17.5 million accounts.
While the emails about resetting passwords really did come from Instagram, there was in fact no danger, and no need to boost account security. So far, so unclear. So, what is going on?
Precise details of what happened are still to be revealed ,but it appears that two completely unrelated incidents have been linked together and caused widespread panic.
While it is true that there was an incident in 2024 involving the leak of some Instagram data to the dark web, the password reset was completely unrelated. Something – as yet not fully explained – made it possible for a third-party company to instigate a password reset mail out when it was not needed.
Posting on X, Instagram said that there had not been a security breach, but failed to explained quite what had caused the password reset email chaos. The company said:
We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion.
We fixed an issue that let an external party request password reset emails for some people. There was no breach of our systems and your Instagram accounts are secure.
You can ignore those emails — sorry for any confusion.
— Instagram (@instagram) January 11, 2026
It is hard to say why Instagram is being so cagey here. It would be quite reasonable to expect the social media giant to give more details about what went wrong. Questions about the identity of the company responsible for the emails, and just how such an event happened in the first place, remain.
While it is good to have confirmation that data is safe, more information would give people greater confidence.
