# The Instagram data breach, explained

Source: https://joinrepass.com/breach/instagram/
Index: https://joinrepass.com/llms.txt

Data breach · 2026

Instagram (instagram.com) was breached on January 7, 2026, exposing 6.2 million accounts. Here is exactly what leaked, what it means, and the order to fix things in.

6,215,150 accounts · 5 data classes · verified record

The numbers

## What the record shows

What leaked

## 5 kinds of data were exposed

The universal account key. Exposed addresses get targeted with credential-stuffing and phishing that name the breached site to look legitimate.

Coarse location history attached to your identity.

Enables SIM-swap attempts and smishing, and links this account to every other one that knows the number.

Ties this account to your other accounts that share the handle, which is how one breach becomes a map of your online life.

In this order

## What to do now

- Rotate the Instagram password anywayPasswords were not in this record, but leaked profile data makes targeted phishing against this account more convincing, and rotation costs one minute. Our [Instagram reset guide](https://joinrepass.com/reset/instagram-password/) has the official links.

- Kill the reuse, which is the real damageEvery account sharing that password is now one automated attempt from gone. This is the tedious part, and it is the part Repass automates: it finds the accounts and runs each site's official reset flow for you.

- Scan your email for the rest of your exposure[Run the free breach scan](https://joinrepass.com/) on the address you use most. Instagram is one breach; the median active email address appears in several, and what to fix first depends on the full picture.

- Turn on two-factor authenticationA leaked password with a second factor in front of it is a locked door with a stolen key that no longer fits. Prefer an authenticator app over texted codes where the service offers the choice.

Questions

## Instagram breach FAQ

The record covers 6,215,150 accounts. The quick way to check is a breach scan against your own email address, which searches this breach and hundreds of others at once. Repass runs one free on its homepage.

Passwords were not in this record, so the urgent risk is targeted phishing that uses the leaked details to sound legitimate. Treat unexpected Instagram-branded email with suspicion, and rotate the password anyway if it is one you reuse.

Only if that password lived nowhere else. Credential-stuffing takes leaked email-and-password pairs and tries them on banks, mailboxes and stores at machine speed, so the reused copies matter more than the original. A reused password is a breach of every account that shares it.

From the public index maintained by Have I Been Pwned, which verifies breaches before listing them. This page renders the structured record: dates, account count and exposed data classes.

Run a breach scan on your email address. It returns every verified breach that lists the address, which is the honest starting point for deciding what to reset first. Repass then resets the passwords for you, one official flow at a time, and seals each new one in an encrypted vault.

More records

## Other major breaches

[All 851 breach records](https://joinrepass.com/breach/)

After the breach

## Every reused password, replaced for you.

3-day free trial · strong unique passwords · encrypted vault

Generated from the page itself. Structured data for this site: https://joinrepass.com/api/v1/services.json