Meta fixes Instagram password reset flaw, denies data breach

Meta fixed a vulnerability in Instagram's password reset function that permitted external parties to trigger password reset emails and stated there was no system breach; meanwhile researchers and Have I Been Pwned report a separate dataset of roughly 17–18 million Instagram-related records (usernames, account IDs, ~6.2M emails, some phone numbers and geolocation/home addresses) being sold as a “doxxing kit,” likely compiled by correlating Instagram IDs with external data brokers or leaked customer records, creating significant real-world safety and privacy risks.