Meta Fixes Instagram Flaw Behind Surge in Legit Password‑Reset Emails

Fox’s tech column reports a January surge of unexpected Instagram "Reset your password" emails, many of them legitimate messages triggered when unknown parties run usernames or emails through Instagram’s real password‑reset form. A Meta spokesperson confirms the company "fixed an issue that allowed an external party to request password reset emails for some Instagram users," while insisting there was no breach of its core systems and that accounts remain secure. The article notes that a BreachForums post in early January 2026 allegedly exposed data tied to about 17.5 million Instagram accounts, timing that coincides with the reset‑email wave and could have given attackers a large list of targets, though a direct link is not proven. Security experts quoted in the piece describe the campaign as social engineering that relies on panicked users clicking through reset links, choosing weak or reused passwords or falling for follow‑on phishing pages, and urge people to treat surprise resets as a warning to harden logins with strong, unique passwords and two‑factor authentication. For U.S. users, the episode highlights how even unbreached platforms can become vectors for account takeovers when attackers exploit normal recovery tools at scale.