Instagram denied a breach of its systems — but also warned that those sketchy password reset emails were triggered by an external party.
The entire situation is bizarre and, frankly, confusing.
Instagram released a statement over the weekend denying its systems had been breached, though the company did confirm that external parties had been able to trigger password reset emails. So, while many customers did receive unnecessary and unprompted password reset emails, the emails themselves may have been legitimate.
“We fixed an issue that let an external party request password reset emails for some people,” Instagram’s account on X posted. “There was no breach of our systems and your Instagram accounts are secure. You can ignore those emails — sorry for any confusion.”
Mashable Light Speed
This Tweet is currently unavailable. It might be loading or has been removed.
Strangely, Instagram users can check their account settings to view all official emails Instagram has sent in the past 14 days; however, the recent password reset emails are not showing up in some users’ account settings. It appears this feature only shows password reset emails requested by the user.
As a cybersecurity best practice, if you’ve gotten a strange or unexpected password reset email for one of your accounts — even one that looks very convincing — do not click any links until you have verified the email is legit.
As we covered at Mashable over the weekend, users online reported a sudden influx of password reset emails from Instagram. Cybersecurity-focused TikTok account @ohhackno posted an explainer on the issue that garnered more than 4 million views.
There were concerns that the reset emails were related to reports of a breach at Instagram, which the company has now denied.
So, for now, follow Instagram’s advice and ignore the emails.
