Comment by Aurornis
13 hours ago
Instagram password reset can start from an email address.
> If my info got out, it likely came from Instagram’s side, not mine.
Did you use a burner email account to register? An account that was never used for anything else?
I just checked, and Instagram’s password reset flow allows requesting a reset using an email address, a phone number, or even the username [1]. The username is public information, so triggering password reset emails is relatively easy.
[1] https://www.instagram.com/accounts/password/reset/ (screenshot: https://imgur.com/a/4x5HPLx)
Ahhhhh, no. This account was registered pre hide-my-email days.
Yeah, common surprise point for services that have any form of username recovery from email.