The Instagram API Scraping Crisis: When ‘Public’ Data Becomes a 17.5 Million User Breach

**Executive summary:** A January 2026 dataset of 17.5 million Instagram user records was posted publicly after large-scale API scraping exploiting a 2024 API vulnerability; while passwords and private content were not exposed, 6.2M records include email addresses and some phone numbers, enabling phishing, SIM swapping, credential stuffing and targeted social engineering, and the report calls out systemic API security failures, legal gaps, and recommended mitigations for users and platforms.