Instagram password reset emails surge after large-scale requests

Many Instagram users reported unexpected password reset emails after a dataset linked to 17.5 million accounts appeared on BreachForums; Instagram says reset messages come only from @mail.instagram.com and that a reset email alone does not prove a breach.

Users worldwide have reported unexpected Instagram password reset emails. A Forbes contributor, Davey Winder, said he received a legitimate-looking message that claimed a password reset request and showed a Reset Password button and a "let us know" link. Reporting links the surge to a dataset posted on BreachForums that was described as containing information on 17.5 million Instagram accounts. Key details: - Numerous users received reset emails that appeared to come from Instagram. - The messages described a password reset request and included a prominent Reset Password button and a "If you didn't request a password reset, let us know" message, as reported by Forbes. - Forbes reported the timing followed a BreachForums post that reportedly listed data on 17.5 million accounts. - Instagram says reset emails are sent only from addresses ending in @mail.instagram.com, that receiving a reset email does not automatically indicate a breach, and that it offers two-factor authentication and an account recovery process in its Help Center; The Independent has contacted Meta for comment. Summary: The reported emails coincided with a reported public data post and created a notable spike in password reset activity. Instagram has clarified how its reset messages are sent and referenced its account recovery and two-factor authentication resources. Undetermined at this time.