The leaked database of 17 million Instagram users appeared on the darknet
The other day millions of Instagram users, including me, received the same alarming email at four in the morning: someone was trying to get into the account.
Panic followed, and dubious blogs and media outlets began spreading these claims:
- allegedly on 10-12 January 2026 the largest hack in Instagram's history had taken place and 17 million users had been affected,
- and that our logins and passwords had leaked to darknet forums together with our postal, physical (!) addresses.
Instagram did not comment at first, which made it look as if the company had suffered a real data-protection failure.
What actually happened
I checked the reporting from TechCrunch, Engadget and others, and found a different story:
- The leaked database of 17 million Instagram users did appear on the darknet last week1 (I am not going to give the link).
- But it is not "real" - the database was cobbled together from scraps with so-called AI-powered credential stuffing2.
- In other words, AI agents can now "enrich" databases that have already been stolen3, in this case a database of Instagram users from 2022-2023.
- Instagram's defenses were imperfect, but they held: not a single account was actually broken into.
What to do about it
Change your Instagram password (especially if you have not changed it since 2022), and turn on two-factor authentication5!
References
- Have I Been Pwned - check whether your address appears in known breach corpora - https://haveibeenpwned.com/↩
- OWASP, Credential Stuffing Prevention Cheat Sheet - https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html↩
- ENISA, Threat Landscape - annual analysis of credential-based attack trends - https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape↩
- Steinberg, A. N., Bowman, C. L. and White, F. E., Revisions to the JDL Data Fusion Model, Proc. SPIE 3719, Sensor Fusion: Architectures, Algorithms and Applications III (1999) - the reference model behind the term - https://doi.org/10.1117/12.341367↩
- NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management - https://pages.nist.gov/800-63-3/sp800-63b.html↩