Did You Receive Password Reset Emails From Instagram, Too?

(SPOT.ph) If you recently opened your inbox to find a password reset email from Instagram you didn’t ask for over the past week, you weren’t alone—and no, your account wasn’t necessarily hacked.

Panic grew after security company Malwarebytes posted on X, claiming that hackers had stolen data from 17.5 million Instagram accounts to be sold on the dark web. However, Instagram clarified the emails were triggered by a technical issue, not a data breach. An external party exploited a flaw in how password reset requests were generated, causing legitimate reset emails to be sent without account owners initiating them.

In other words, someone figured out how to spam the “forgot password” function—but not how to break into accounts.

A password reset email on its own doesn’t give anyone access to your account. The link requires the recipient to complete the process—not to mention it expires quickly if you don’t—so if you didn’t click it, nothing changed. Instagram also notes on its help page that receiving a reset email doesn’t automatically point to malicious activity.

“Receiving a password reset email doesn’t necessarily mean that your account has been hacked. For example, when someone is trying to log into their account or reset their password, they may mistype or misremember their email address or username and enter yours by mistake. Only people who know your Instagram password or click the login link in this email can log in to your account.”

On January 11, Instagram said the issue has since been addressed and fixed, assuring users that no account data was compromised.

Also read: So, Looks Like You Can’t Delete Threads Without Deleting Your Instagram; What Now?

For users who received the email, Instagram said there’s no need to reset your password unless you actually initiated the request or notice suspicious activity on your account. Changing passwords directly through the app and enabling two-factor authentication remain standard safety measures, but the company maintains that the incident did not compromise accounts.

Instagram reminds its users: “Emails from Instagram will only come from @mail.instagram.com. If the email you received did not come from us, it may be a phishing attempt and you shouldn’t click any links or attachments.”

Also read: Instagram Grids Changed From Squares to Rectangles—Here’s Why