Meta Platforms Inc.-owned Instagram has denied it suffered a data breach after a wave of unsolicited password reset emails sparked claims that data from more than 17 million user accounts had been leaked.

Reports that Instagram had been breached first emerged after large numbers of users reported receiving password reset emails they had not requested. The sudden spike led to speculation that attackers had gained access to Instagram’s internal systems and were attempting to take over accounts at scale.

Adding to the speculation were reports from cybersecurity researchers claiming that a dataset containing information tied to 17.5 million Instagram accounts was being offered for sale on underground forums. The data was said to include usernames, email addresses, phone numbers and, in some cases, physical location details.

In a statement reported today by Bleeping Computer, Instagram said there was no evidence that its systems were breached or that attackers gained unauthorized access to user data. Instead, Instagram says that the surge in password reset emails was the result of an external party abusing a bug that allowed password reset messages to be triggered in large numbers without compromising account credentials or backend infrastructure.

“We fixed an issue that allowed an external party to request password reset emails for some Instagram users,” a Meta spokesperson said. “We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused.”

Though there may be an Instagram-related dataset on a hacking site, it does not necessarily indicate that there was a new breach, but instead it could involve past scraping incidents and older data collections. Such datasets have appeared in the past and have been branded as “new leaks,” particularly when unrelated platform issues draw public attention.

Instagram is investigating the origin of the dataset.

Even with data seemingly not stolen, users of Instagram, as with all online accounts, should always be cautious and avoid clicking links in unsolicited emails, manually navigate to Instagram to change passwords if concerned, and use two-factor authentication to reduce the risk of account takeover.

Image: SiliconANGLE/Ideogram