Instagram massive data leak exposed: 17.5 million user privacy data leaked onto the dark web

Meta’s Instagram recently experienced a serious data security breach. According to security research firm Malwarebytes, personal information of approximately 17.5 million users was leaked, including usernames, email addresses, phone numbers, and physical addresses. Even more concerning, this user data has been uploaded to the dark web for sale, potentially being used by malicious actors for large-scale phishing scams and account hijacking attacks.

Source of Leak and Technical Flaws

Security experts point out that the root cause of this incident is likely directly related to an API vulnerability exposed by Instagram in 2024. This flaw allowed unauthorized third parties to access user data, ultimately leading to this large-scale privacy breach. Affected users have recently reported receiving continuous password reset emails, indicating that attackers have begun exploiting the leaked information for malicious activities.

Official Response and Security Recommendations

As of now, Meta has not issued an official statement or provided related remedial measures regarding this incident. In the absence of an official response, security agencies have issued a series of protective suggestions for affected users:

• Enable two-factor authentication (2FA) immediately to protect your account
• Change your Instagram password as soon as possible, and avoid using simple or repeated passwords
• Stay vigilant and be cautious of emails and messages from unknown sources
• Monitor your account login records, and change your password immediately if you notice any suspicious activity

For users who find their information on the dark web, it is recommended to also change passwords on other related platforms to prevent account linkage attacks.