Cybersecurity company Malwarebytes has disclosed a major security incident involving Instagram, revealing that personal data from approximately 17 million users has been leaked and is now circulating on the dark web.

According to the firm’s investigation, the breach exposed sensitive information including usernames, email addresses, phone numbers, and location details. Experts warn that the leaked data could be exploited in phishing campaigns, where victims receive fraudulent emails designed to trick them into revealing login credentials or clicking malicious links that compromise their accounts.

Malwarebytes noted that the breach was detected in early January 2026, when large datasets linked to Instagram users appeared for sale on underground forums. The company emphasized that the scale of the leak poses a serious risk of identity theft, account hijacking, and financial fraud, particularly for influencers and businesses that rely heavily on Instagram for communication and commerce.

Privacy advocates have urged Meta—the parent company of Instagram to issue a transparent statement and strengthen its security protocols. While Meta has yet to provide detailed clarification, cybersecurity specialists recommend that users take immediate precautions: