Who’s Targeted in the lines_instagram Leak of 469,232 Logins

HEROIC analysts discovered a combolist called lines_instagram circulating on Telegram, dated January 6, 2026, pairing 469,232 email addresses with plaintext passwords and the URLs those logins were used on. The file groups credentials specifically tied to Instagram-related sign-ins. Scanning your email is the only way to know if yours is part of the discovery.

Who Ends Up in a List Like This One

Nobody is targeted here by identity, only by habit. Anyone who reused the same password on an Instagram login that they also used somewhere else is exactly who a file like this is built to catch, regardless of how often that account actually gets used.

What Was Exposed

• Email Addresses: shows which account each stolen password belongs to.
• Plaintext Password: appears exactly as typed, ready for immediate use.
• URLs: identifies the Instagram login the credential pair was captured from.

Why This Matters

A social media login is rarely isolated, since many people use it to sign into other apps and services through a connected login feature. A password that unlocks Instagram in this file could just as easily unlock everything tied to it elsewhere.

How This Breach Type Works

lines_instagram wasn't the result of a breach at Instagram itself. It was built by comparing credentials already leaked in separate incidents and keeping the pairs where a password repeated, labeled afterward by the login it was last confirmed against.

Is Your Instagram Login Inside lines_instagram?

Check the scan your email tool above first. If your information turns up, change that password on Instagram and anywhere else you've used it, and review any apps connected through it while you're there. This matters whether the account involved is personal or tied to your work.