Meta has moved to explain why Instagram users have reported receiving a deluge of password reset emails, amid fears they had their personal details leaked.

Cyber experts originally reported that around 17.5million accounts were targeted in a data breach, with sensitive data released onto the dark web including user names, full names, email addresses, phone numbers, partial physical addresses and other contact details.

The breach was revealed on X by security firm Malwarebytes on Saturday, which warned that the leaked data had likely been shared with cyber criminals.

While the leaked information did not appear to also contain passwords, personal data that falls into the wrong hands can be used to commit identity and financial fraud.

According to tech publication CyberInsider, the data was first stolen during an Instagram API leak in 2024, in which the hacker bypassed standard security protections to scrape the sensitive data. 

Then a threat actor named ‘Solonnik’ published the dataset on BreachForums on  Wednesday, offering it for free.

According to the poster, the dataset comprised more than 17million records – a number that experts say indicates a significant leak.

Thousands of people then reported having received multiple password reset request emails over the last few days, The Verve reported.

Typically people had been receiving an email from Instagram claiming that a password reset had been requested on the account.

The email features a large blue Reset Password button alongside the message, ‘If you ignore this message, your password will not be changed. If you didn’t request a password reset, let us know.’

But on Sunday, Meta moved to reassure users that there had been ‘no breach’ and that accounts ‘remain secure’.

A spokesperson said: ‘We fixed an issue that allowed an external party to request password reset emails for some Instagram users. 

‘We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. 

‘People can disregard these emails and we apologize for any confusion this may have caused.’ 

For anyone concerned they may have had their data leaked, visit HaveIBeenPwned.com or malwarebytes.com, which can check if an email address has been compromised on Instagram and other websites.

Malwarebytes advises people to change their passwords and enable two-factor authentication (2FA) for enhanced security.