In January 2026, a significant data exposure incident occurred involving the scraping of information from Instagram’s API. The compromised dataset comprised around 17 million entries of publicly accessible user information, which included usernames, display names, account IDs, and some instances of geolocation data. Notably, approximately 6.2 million of these entries were linked to email addresses, while a subset also contained phone numbers. It is important to note that this scraped data does not appear to be connected to any password reset requests made on the platform during the same period. Fortunately, there is no indication that passwords or other sensitive personal information were compromised.

• Breach date: 2026-01-07
• Persons affected: 6,269,794
• Exposed records: 16,705,730

Data exposed: Name, Handle, Phone, Address, Email

Potential risks

Potential risks associated with the exposed data include unauthorized access to user accounts, potential phishing attacks targeting email addresses, and harassment or unwanted contact due to the availability of phone numbers and geolocation data.