Instagram password reset email controversy and leak allegations
Concerns grew as users received password reset emails amid allegations that data from 17.5 million Instagram accounts had been leaked. Instagram denied any data breach and fixed a password reset vulnerability.
Key facts
- Affected organisation
- Meta
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- Password reset vulnerability
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- Allegations surfaced that data from 17.5 million Instagram accounts had been leaked.
- Instagram denied breach allegations related to the password reset emails and fixed the reset vulnerability.
7 related reports
- 17.5 Million Instagram Accounts Exposed in Major Data Leak
- Here’s the truth about Instagram Data Breach 2026
- Instagram Fixes Password Reset Vulnerability Amid User Data Leak
- There was no data breach, Instagram says
- Instagram users fear data breach after password reset emails
- Instagram denies breach after users receive password reset emails
- Instagram hacked? 17.5 million users received fake password reset emails
Other incidents at Meta
Meta GitHub Breach Exposes Code and Personal Data of 1,500 People
1.5kImpact: Code and personal data of 1,500 people
Meta said hackers stole code and the personal data of 1,500 people through a breach of GitHub. The date of the incident, the specific intrusion method and the follow-up response measures have not been confirmed.
Read on SecurityWeek ↗Meta halts staff-tracking AI training after internal data leak
An internal data leak occurred at Meta. Meta subsequently suspended an AI training programme that tracked employees' keystrokes.
Related reports: 2 →Abuse of Meta AI support tool leads to takeover of over 20,000 Instagram accounts
Impact: Takeover of more than 20,000 Instagram accounts
Attackers tricked Meta's AI support chatbot into granting them access to other users' Instagram accounts. Meta sent notifications to targeted users and took steps to protect the hacked accounts. The scale of the damage disclosed on 8 June 2026 was more than 20,000 accounts.
Related reports: 16 · last report →Meta halts collaboration with Mercor after data breach
↳ Knock-on damage from the Mercor incident · View original incidentA data breach at Mercor put AI industry secrets at risk. Meta temporarily suspended its collaboration with Mercor following the incident. Whether any Meta information was specifically leaked and the extent of the damage have not been confirmed.
Read on WIRED ↗Meta AI agent's instructions expose sensitive data to employees
Impact: Large amount of sensitive information
At Meta, a large amount of sensitive information was exposed to employees as a result of an AI agent's instructions. The specific types of information, the scale of the damage, the date of the incident and the response have not been confirmed.
Read on The Guardian ↗Meta sued over alleged personal data leak from AI smart glasses
Meta has been sued over an alleged personal data leak involving its AI smart glasses. Whether a leak actually occurred, the scale of the damage, the date and Meta's response have not been confirmed.
Read on Vietnam.vn ↗Meta wins class action over Facebook account hacks
A class action lawsuit was filed against Meta over Facebook account hacks. Meta won the lawsuit, and the dates and scale of the account hacks have not been confirmed.
Read on Bloomberg Law News ↗WhatsApp vulnerability exposes data of 3.5 billion users
3.5bnImpact: Data of 3.5 billion users
A WhatsApp vulnerability exposed the data of 3.5 billion Meta users. The specific data exposed, when the incident occurred and Meta's response have not been confirmed.
Related reports: 2 · last report →Hacker claims leak of 1.2 billion Facebook user records
1.2bnImpact: Claimed leak of 1.2 billion user records
A hacker claimed that 1.2 billion Facebook user records had been leaked. Whether a leak actually took place, the results of any verification of its scale and the company's response have not been confirmed.
Read on Cybernews ↗Zero compensation for 3.3 million victims of Meta data leak
3.3mImpact: Personal data of 3.3 million people
A Meta personal data leak affected 3.3 million people, but compensation amounted to nothing. Calls were made to expand the scope of the class action system to provide redress for victims.
Read on 국민일보 ↗
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.