Instagram stated that it had not experienced a breach, despite some users receiving password reset requests that raised concerns. The statement followed a post on Bluesky by antivirus software company Malwarebytes, which included a screenshot of an Instagram email notifying a user of a password reset request.

Malwarebytes claimed in its post Friday that cybercriminals had stolen sensitive information from 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, and email addresses. The company further alleged that this data was for sale on the dark web and could be exploited by cybercriminals.

Instagram responded on X, formerly Twitter, stating that it had resolved an issue that allowed an external party to request password reset emails for some users. The company did not disclose details about the external party or the specific nature of the issue. Instagram's post concluded with an apology for any confusion and advised users to ignore the suspicious emails.

The discrepancy between Malwarebytes' claim of a large-scale data theft and Instagram's assertion of no breach highlights the challenges in assessing and reporting cybersecurity incidents. Password reset requests, while often legitimate, can also be a tactic used by malicious actors to gain unauthorized access to accounts, a technique known as credential stuffing. In credential stuffing attacks, cybercriminals use lists of usernames and passwords obtained from previous data breaches to attempt to log in to accounts on other platforms.

Instagram's lack of transparency regarding the specific vulnerability and the external party involved has drawn criticism from security experts. Without more information, it is difficult to assess the potential impact on users and the effectiveness of Instagram's response. The company's decision to announce the fix on X, rather than its own platform, also raised questions.

The incident underscores the importance of strong password hygiene and enabling two-factor authentication, which adds an extra layer of security by requiring a verification code from a user's device in addition to their password. Users who received suspicious password reset requests should change their passwords immediately and monitor their accounts for any signs of unauthorized activity.

Instagram has not yet provided further updates on the situation. The company's handling of this incident will likely be closely scrutinized by security researchers and users alike, as it raises concerns about data security and transparency.