Data from approximately 17.5 million Instagram accounts has been leaked and put up for sale on cybercrime forums, placing millions of users worldwide at risk of cyberattacks and digital security breaches.

The leaked dataset is believed to have been collected throughout 2024 and began circulating publicly on underground forums in early January 2026. The files reportedly contain users’ names, usernames, email addresses, phone numbers, and other contact details. As a result, affected users face heightened risks of scams such as impersonation, phishing, account takeover through password resets, or SIM swap attacks.

In response to this situation, Bkav recommends that users remain vigilant and take the following security measures:

• Change Instagram passwords and those of related services immediately if any suspicious activity or unusual notifications are detected.

• Enable two-factor authentication (2FA); using authenticator apps is strongly recommended over SMS to reduce the risk of abuse.

• Avoid clicking on links in emails from unknown or unverified sources, even if they appear to resemble official communications.

• Secure the primary email account linked to Instagram with a strong, unique password that is not reused across other services.

Bkav