Malwarebytes Warns Massive Instagram Data Leak Hits 17.5M Users
Cybersecurity firm Malwarebytes has issued a critical warning regarding a massive Instagram data leak exposing the personal details and credentials of over 17.5 million users worldwide.
Cybersecurity research firm Malwarebytes has issued an urgent warning to social media users following a massive data leak involving over 17.5 million Instagram accounts.
The compromised dataset, which surfaced on an underground hacker forum, contains sensitive user information including full names, email addresses, phone numbers, location data, and linked account metadata.
What Happened?
Security analysts believe the leak stems from a combination of API scraping vulnerabilities and compromised third-party analytics services that had authorized access to Instagram user data. While Meta has clarified that main account passwords were not directly exposed in plain text, the leaked information poses a severe risk of targeted phishing attacks, SIM-swapping, and credential stuffing.
"Exposed phone numbers and email addresses linked to social media handles provide cybercriminals with the exact blueprint needed for highly effective spear-phishing campaigns," warned Malwarebytes security researchers.
Key Risks for Instagram Users
- Targeted Phishing Emails: Scammers sending fake copyright infringement notices or account verification emails.
- SIM-Swapping Attacks: Using leaked phone numbers and personal details to hijack mobile numbers and bypass two-factor authentication (2FA).
- Social Engineering: Impersonating Instagram support to trick high-profile creators and businesses into surrendering access.
Recommended Security Steps
- Enable App-Based Two-Factor Authentication (2FA): Switch from SMS-based 2FA to an authenticator app like Google Authenticator or 1Password.
- Be Wary of Unsolicited Messages: Never click links in emails claiming your Instagram account is suspended or copyright-flagged.
- Audit Authorized Apps: Go to Instagram Settings > Website permissions > Apps and websites, and revoke access for unused third-party apps.
- Change Account Password: Update your password to a strong, unique passphrase.
📌 Stay Vigilant: As data leaks become increasingly common, protecting your accounts with strong multi-factor authentication remains your best defense.