[ivan_gammel]

If mailboxes of some people were breached, those reset emails can be used to steal their Instagram accounts. So it can be some other breach being exploited, rather than a vulnerability in Instagram account itself.

[thunderbong]

If my mailbox is breached, Instagram will be the least of my worries.

[gloxkiqcza]

Password reset emails usually contain a token that expires rather quickly so unless I’m missing something, this should be a non-issue.

[Fire-Dragon-DoL]

But you can generate such emails with a public username

[SkyPuncher]

Yep. And if you also have access to my email, you can already look at it to figure out exactly what services I have an account with.

If you’ve pawned my email address, you can get my user names, send email reset, etc, etc.

[ipaddr]

Or the email address you have already hacked into. Why both with the username at that point.

[stackghost]

It wouldn't be reported as an Instagram breach, in that case.

[faust201]

And that would also apply to everything. What else? Banks.