The message said:

“Hi ,
We got a request to reset your Instagram password.
If you ignore this message, your password will not be changed. If you didn’t request a password reset, let us know.”

It is believed that 17.5 million user details have been made public on the dark web.  These records include:

• Usernames
• Full names
• User IDs
• Email addresses
• Phone numbers
• Countries
• Partial locations

Please note it is believed that there are no passwords listed in the data.

What to do to stay safe….

If you haven’t already, enable 2SV/2FA on your Instagram account.  We would suggest doing this via an authenticator app rather than text message.

Change your password.  Using the NCSC guidance of linking three random words together rather than using personal information such as pet name or favourite football team.

If you do change your password, do this via the app or on the trusted website and do not click on any links in the email.

Another thing to keep in mind is that some users may have linked their Instagram to their Facebook or WhatsApp accounts.  You can check recent logins or active sessions and log out from any devices that you do not recognise.

Lastly have you changed your email password recently.  If you haven’t, consider changing this password too, using a unique password and not the same as your Instagram!

More help and guidance on how to stay safe online can be found here –  Cyber & Fraud Protect for Individuals