Leak at Instagram

On 12 January 2026, Instagram — Meta's photo- and video-sharing platform — was reported to be at the center of a data leak after a dataset of roughly 17.5 million user records was put up for sale on a dark-web forum. The dataset, listed by a threat actor using the alias "Solonik," was titled as a global Instagram "API leak" and is believed to have been harvested in late 2024 through a misconfigured or abused API endpoint rather than a direct intrusion into Meta's servers.

The exposed records, circulated as JSON and TXT files, reportedly included:

• Usernames and full names
• Numeric user IDs
• Email addresses
• Phone numbers
• Country and partial location / postal data

Because the data resembled native API responses, investigators (including Malwarebytes, which surfaced the set during dark-web monitoring) assessed it as the product of large-scale profile scraping, with the physical-address fields likely enriched from external marketing databases. Around the same time, large numbers of users received unsolicited password-reset emails, as attackers used the leaked email addresses and phone numbers to trigger resets at scale and set up phishing and social-engineering attempts.

Meta downplayed the incident, stating there was "no breach of our systems" and that accounts remained secure, and said it had fixed a technical issue that had allowed an external party to request password-reset emails for some users. As of disclosure the company had not confirmed the specific 17.5-million-record dataset, and the data remained in circulation — leaving affected users exposed to phishing and account-takeover risk. The status remains ongoing.