If you received a bunch of password reset requests from Instagram recently, you’re not alone. As reported by Malwarebytes, an antivirus software company, there was a data breach revealing the “sensitive information” of 17.5 million Instagram users. Malwarebytes added that the leak included Instagram usernames, physical addresses, phone numbers, email addresses and more.

The company added that the “data is available for sale on the dark web and can be abused by cybercriminals.” Malwarebytes noted in an email to its customers that it discovered the breach during its routine dark web scan and that it’s tied to a potential incident related to an Instagram API exposure from 2024.

The reported breach has resulted in users receiving several emails from Instagram about password reset requests. According to Malwarebytes, the leaked information could lead to more serious attacks, like phishing attempts or account takeovers. Meta hasn’t released an official statement about the latest incident, but it’s not the first time Instagram’s parent company has been in hot water for data breaches. If you haven’t already, it’s always a good idea to turn on two-factor authentication and change your password. Even better, you can review what devices are logged into your Instagram account in Meta’s Accounts Center.