Instagram data breach
6,215,150 accounts exposed in a breach on 7 January 2026.
At a glance
6,215,150
Accounts exposed
7 January 2026
Date of the breach
11 January 2026
Added to the list
What happened
In January 2026, data allegedly scraped via an Instagram API was posted to a popular hacking forum. The dataset contained 17M rows of public Instagram information, including usernames, display names, account IDs, and in some cases, geolocation data. Of these records, 6.2M included an associated email address, and some also contained a phone number. The scraped data appears to be unrelated to passw
What was exposed
- Display names. This kind of data was included in the breach. Treat it as exposed and be careful with messages that use it.
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Geographic locations. General locations were exposed. They add to a profile of you.
- Phone numbers. Phone numbers were exposed. Expect scam calls and text messages, some of them pretending to be the organisation.
- Usernames. Usernames were exposed. Together with a reused password they open accounts.
What to do now
It depends on what was exposed, so these steps follow the list above.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Double Counter
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool.
- Email addresses
- Geographic locations
- Names
- Usernames
Read what happened
Chess.com (2026)
In August 2026, millions of records allegedly sourced from Chess.com were posted online.
- Email addresses
- Geographic locations
- Names
- Usernames
Read what happened
Manchester Airports Group
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services.
- Browser user agent details
- Email addresses
- Geographic locations
- IP addresses
- +4 more
Read what happened