TL;DR: Recover a hacked Instagram account by matching the fix to what the attacker changed. If your email was changed, the deny link in the [email protected] message comes first; if every contact detail is gone, use instagram.com/hacked and verify with a video selfie or your sign-up details. Then turn on two-factor authentication: the 20,225 takeovers Meta disclosed in June 2026 only worked on accounts without it.

You opened Instagram and you cannot log in. The password you have memorised does not work. Maybe the email on the account changed, maybe the phone number is gone, maybe the profile photo is now a crypto logo.

Take a breath. Instagram runs its own recovery forms for exactly this, but the right first move depends on what the attacker changed. A password reset is useless once the codes are going to the attacker’s inbox.

This guide walks the recovery as a four-level decision tree, then covers the hardening pass that keeps the same person from getting back in. Every menu path below matches Instagram’s Help Center as of October 23, 2026, including its note that some people now manage these settings in a Meta Account instead of Accounts Center.

How To Diagnose The Level Of The Hack

The level of an Instagram hack depends on what the attacker changed before you noticed: the password, then the email, then the phone number, and finally the username and two-factor authentication.

Most failed recoveries come from running a Level 1 fix on a Level 3 problem, then waiting for a code that is being sent to the attacker.

Walk through the four levels in order and stop at the first one that matches your situation.

Level	What the attacker changed	Your fastest path
1	Password only	Tap “Forgot password?” and send a login link to the email or phone you still control
2	Password and email	Open the [email protected] email in your old inbox and tap “secure my account”
3	Password, email, and phone	Go to instagram.com/hacked, then verify with a video selfie or your sign-up details
4	Everything above, plus the username and 2FA	Run the Level 3 route, then remove the attacker’s 2FA, passkeys and linked profiles

If you can still log in and nothing has changed yet, you are not at Level 1. A warning without a takeover calls for the quicker steps below.

What If Your Phone Says Your Instagram Password Was In A Data Leak?

A data leak alert means a password you saved for Instagram matches one on a known leak list. Your account may still be untouched, so change the password inside the app before anyone uses it.

The alert usually comes from your phone or browser, which check saved passwords against known leaks. Apple says iPhone can “securely monitor your passwords and alert you if they appear in known data leaks” (Apple Support). Google’s Password Checkup flags the same problem as an exposed password (Google Account Help).

1. Change your Instagram password from the app’s settings, not from a link in an email.
2. Turn on two-factor authentication with an authentication app.
3. Open Where you’re logged in and remove any device you do not recognise.
4. Change the same password on every other site where you used it.

A password reset email you never asked for is usually a related false alarm. After a wave of unrequested reset emails, Instagram said on January 11, 2026 that it “fixed an issue that let an external party request password reset emails for some people” (Tom’s Guide). It added that there “was no breach of our systems”.

Malwarebytes put the number of affected users at 17.5 million, and Instagram’s advice was to ignore those emails. Do not tap anything inside an email you did not request; change the password from the app instead.

What To Do Hour By Hour After An Instagram Hack

The first hour after a hack matters because the deny link in Instagram’s security email is the quickest fix when your email was changed. It only works while that email is still in your old inbox. After that, recovery runs through Instagram’s support forms, which publish no response time.

Work from the moment you realise the account is compromised.

1. Minute 0 to 60. Search every folder of your email, spam and trash included, for [email protected]. If a message says your email address was changed, tap “secure my account” inside it to reverse the change (Instagram’s hacked-account help). If there is none, send a login link from “Forgot password?”, and if it reaches the attacker, go to instagram.com/hacked right away with a secure email only you can access.
2. Hour 1 to 6. Lock down the email account itself: change its password, sign out other sessions and delete any forwarding rule you did not create. Whoever holds that inbox can undo every fix you make on Instagram.
3. After you submit. If you used instagram.com/hacked, complete the video selfie or sign-up details check Instagram asks for, then follow the steps it emails to your secure address.
4. Day 1 onward. Check that secure inbox and its spam folder every day. If Instagram stops sending codes after repeated tries, space the attempts out rather than refilling the form every few minutes.

While you wait, Inflact can save your posts by username with no Instagram login, so you keep a copy if the attacker starts deleting them. It works only while the profile is public and cannot reach DMs.

Level 1, Password Only Changed

A Level 1 hack means the attacker changed only the password and left your email and phone in place, so Instagram’s login link still reaches you.

This is the fastest recovery on Instagram, because the reset goes to an inbox or phone you still control.

Run this sequence:

1. On the login screen, tap “Forgot password?”.
2. Enter your username, email address or phone number, then tap Send login link.
3. Complete the captcha, open the link in your email or text message, and set a new password.
4. Open your Meta Account or Accounts Center settings, then Login and security (Password and security in Accounts Center), then Where you’re logged in. Remove every device you do not recognise.
5. Turn on two-factor authentication with an authentication app before you do anything else.

Instagram recommends the authentication app over text messages, because you can add several devices that all get login codes (two-factor authentication help). Save the backup codes it offers, since they let you in if you lose the phone.

If Instagram answers the reset with “Log in on another device to continue”, that is a separate security check. The log in on another device guide covers it.

Level 2, Password And Email Changed

A Level 2 hack means the attacker changed the email on the account, and Instagram’s deny email is waiting in your old inbox. Instagram sends one email to the new address and one to the original, so the real owner can reverse the change.

Here is what to do, in order.

1. Search your original inbox, spam and trash included, for a message from [email protected] about your email being changed.
2. Tap “secure my account” in that message to reverse the change.
3. Send a login link to your restored email and set a new password.
4. Sign out every other session, then turn on two-factor authentication.

Instagram says it only starts this process after an email address is changed from the profile, and that it “won’t change your Instagram email address without your permission” (Hacked Instagram Account help). If you already deleted the message, send a login link to your phone number instead, and treat the hack as Level 3 only if that fails.

If the attacker’s spam gets the account disabled before you are back in, the Instagram account disabled walkthrough covers the appeal.

Level 3, Password Email And Phone All Changed

A Level 3 hack means the attacker swapped your email, phone number and password, so every code goes to them. The route back is Instagram’s support request at instagram.com/hacked, followed by an identity check.

The sequence is fiddly but documented:

1. Go to instagram.com/hacked in a mobile or desktop browser. In the app, tap “Forgot password?” and look for the hacked-account option, whose label varies by app version.
2. Say your account was hacked and enter your username, or an email address or phone number linked to it.
3. Enter a secure email address that only you can access. Instagram sends the next steps there.
4. Complete the identity check Instagram asks for.

The identity check depends on your photos. If the account has photos of you, Instagram asks for a video selfie of you turning your head in different directions (Instagram help).

If it has none, Meta’s support team emails you to ask for the email or phone number you signed up with and the type of device you used, such as an iPhone or Android. Instagram says the selfie video is never shown on Instagram, is deleted within 30 days, and can be resubmitted for a new review if the first one fails.

Instagram’s contact page sends people to the Help Center first and to its hacked-account help for takeovers (points of support). Meta’s recovery hub adds a Meta AI support assistant that Meta describes as “24/7 help on Facebook and Instagram” (Meta).

Meta Verified subscribers also get “chat and email support” from Meta (About Meta Verified). That mainly helps if the account was already subscribed before the hack.

Level 4, Username Changed And 2FA Enabled By Attacker

A Level 4 hack means the attacker also changed the username and turned on their own two-factor authentication, so you have to prove you own an account that no longer looks like yours.

The full Level 4 path:

1. Run the Level 3 request at instagram.com/hacked with the details you still know: your old username, email address or phone number.
2. Complete the video selfie or the sign-up details check.
3. If the form offers to let friends confirm who you are, take it. Instagram opened this to everyone in December 2022: you pick two Instagram friends, and if they respond within 24 hours you can reset your password (Engadget).
4. Once you are back in, remove the attacker’s two-factor method, any passkey you did not create and any linked profile you do not recognise, then add your own authentication app.

Instagram’s current help pages no longer describe the friends option, so treat it as a bonus when it appears. After you get back in, Account history under Your activity shows when the username changed, and the Instagram username history guide covers what other people can still see about your old handle.

What If The Hacker Linked Your Instagram To Their Own Meta Account?

If a hacker moved your Instagram into their own Meta Account or Accounts Center, they can reach it from their other profiles. Meta says that since early 2026, all accounts there “will be able to log into each other by default” (Meta). The four recovery levels still apply, and you must cut that link once you are back in.

Takeovers that bypass every contact point on the account are documented. Meta’s breach notice says attackers abused a bug in High Touch Support, its AI-assisted recovery tool, to send password reset links for 20,225 Instagram accounts to their own email addresses (BleepingComputer). Meta found the bug on May 31, 2026, and its filing with Maine’s attorney general dates the breach to April 17.

Those links only let them in where the owner had not turned on two-factor authentication, and Meta disabled the tool after finding the bug, saying it would fix the email check before relaunching it. Reddit posts from October 2026 show contact details and login protections disappearing. On October 20, one poster said their recovery details were changed and the account linked to a stranger’s Meta account, with Meta calling the decision final (r/InstagramSupport).

Another poster lost their phone number, email, two-factor authentication and passkey the same day (r/Instagram). On October 18 a third, still logged in, found their WhatsApp two-factor method and passkey removed (r/Instagram). All three are unverified posts with no confirmed cause.

Routes that still apply once every contact point is gone:

• The deny link, if the [email protected] email reached your old inbox when the email was changed.
• instagram.com/hacked with a new secure email, because the identity check uses your photos or your sign-up details.
• A second video selfie if the first is rejected, since Instagram says it will review a new video.
• Logging in with Facebook, if your own Facebook was linked to the Instagram before the attack and that link survived.

Once you are back in, open your Meta Account or Accounts Center and remove any profile you do not own, or move Instagram out if the Meta Account is the attacker’s. The what a Meta Account is guide explains how to give Instagram a Meta Account of its own.

Then check Login and security for passkeys you did not create. Meta allows up to five passkeys per Meta Account, and removing one is permanent (About Meta passkeys). Crown Media Creative’s guide to logging someone out walks through removing a stranger’s session and passkey.

If Meta’s answer stays final and you start over on a new account, Kicksta is one tool creators use to rebuild an Instagram following. You pick accounts and hashtags in your niche, and it follows and likes people who follow them. It needs your Instagram password to automate follows, likes and unfollows, and Instagram’s help says an app holding your login can gain complete access to your account, so weigh that first.

The Hardening Pass After You Get Back In

After you get back into a hacked Instagram account, close every door the attacker may have opened: sessions, linked profiles, passkeys, third-party apps and the email account itself.

Run this checklist within the first hour of regaining access:

1. Change the password to a long one you have never used anywhere else.
2. Open Where you’re logged in under Login and security (Password and security in Accounts Center) and remove every device you do not recognise.
3. Check that the email address and phone number in your account settings are yours, and replace any the attacker added (Instagram help).
4. Check the profiles in your Meta Account or Accounts Center. Instagram’s own checklist says to remove “any linked accounts you don’t recognize.”
5. Under Login and security, open Passkey and remove any passkey you did not create.
6. Remove third-party apps: Settings, Website permissions, Apps and websites, Active, then Remove (Instagram help).
7. Replace the attacker’s two-factor method with your own authentication app and save the backup codes.
8. Change the password on the email account linked to Instagram, since whoever holds that inbox can reset Instagram again.
9. Open Recently deleted in the app. Deleted posts, reels, notes and Direct Messages stay there for 30 days, and stories outside your archive for up to 24 hours (Instagram help).

The linked-profile check matters more now that Meta is moving people to Meta Accounts. A stranger’s Facebook left in the same Meta Account keeps a way back into your Instagram, even after you change every Instagram password.

Two-factor authentication is the item most worth doing today. In Meta’s 2026 breach notice, the stolen reset links only worked on accounts that did not have it.

Avoiding The Recovery Phish

The second wave after a hack is the recovery scam: strangers who message you posing as Instagram support or as hackers for hire. Instagram says it “will never reach out to you about profile security through Direct Messaging” (Instagram help).

The rules are simple and they all stack:

• Check the sender. Instagram lists the addresses its official security emails come from: @mail.instagram.com, @support.instagram.com, @facebookmail.com, @support.facebook.com and @global.metamail.com.
• Check Recent emails. Under Login and security, Recent emails lists the official emails Instagram sent you in the last 14 days, which is how you confirm a security email is real.
• Never pay for recovery. Instagram’s recovery forms cost nothing, and its phishing guidance says not to trust messages demanding money or threatening to ban your account.
• Report phishing. Forward suspicious emails to [email protected], the address Instagram gives for reports.
• Ignore “ethical hacker” offers. A real security professional does not cold-message hacked-account victims.

If the account is back but reach collapsed after the attacker’s spam, the shadowban check shows whether Instagram restricted it.

What To Do About The Damage The Hacker Caused

Recovering a hacked Instagram account does not undo the spam DMs, crypto posts or unfollows the attacker sent from it, so a short cleanup pass rebuilds trust with your followers.

A practical order for the cleanup:

1. Post one clean message that you were hacked. A single Story and a single feed post, apologising for any spam DMs your contacts received. Keep it short.
2. Delete what the attacker created. Check the grid, Reels, Stories and Highlights, since spam links can sit in any of them.
3. Message anyone who replied to a spam DM. A direct apology beats a public post for the people who engaged with the spam.
4. Audit your tagged photos. Remove every tag you do not recognise.
5. Post normally again once the cleanup is done. The Instagram reach drop diagnostic covers a longer slump.

Closing Note

Try the routes in this order: the deny link if Instagram’s security email reached you, then the login link, then instagram.com/hacked, and harden the account the moment you are back in. Two-factor authentication with an authentication app is the one setting most worth turning on today.