Jakarta. The Communication and Digital Affairs Ministry has sought an official clarification from Meta Platforms Inc. over allegations of an Instagram user data breach and widespread reports of unsolicited password reset emails.

Alexander Sabar, director general for digital space oversight at the ministry, said Meta — which operates Instagram — has assured authorities that the password reset process is an internal mechanism carried out solely through Instagram’s official systems and does not expose user passwords to third parties.

“Meta has emphasized that no user passwords can be accessed or obtained by anyone other than the account owner,” Alexander said, as quoted by state news agency Antara on Friday. “So far, there are no indications of misuse of the password reset feature for data extraction by external parties.”

Alexander said the ministry’s assessment is ongoing and that the findings will form the basis for further evaluation. He added that Instagram’s official systems are designed to protect user accounts and do not create vulnerabilities that would allow password access by unauthorized parties.

The clarification follows growing public concern after reports circulated online alleging a large-scale data breach linked to Instagram, as well as a spike in emails asking users to reset their passwords without having requested such action.

After meeting with Meta representatives, Alexander stressed that summoning and seeking clarification from electronic system providers falls under the ministry’s authority, as stipulated in Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions.

“The call for clarification is part of the state’s commitment to protecting personal data and maintaining the security of the national digital space,” he said.

The ministry has urged the public to remain calm, avoid reacting to unverified information, and take greater care in securing their digital accounts. It said it would continue monitoring developments and take necessary measures to ensure the safety of electronic systems and the protection of Indonesians’ personal data.

PCMag warned that up to 17.5 million Instagram accounts could be affected by a potential data leak, reporting earlier this week that the alleged breach may have exposed sensitive information such as usernames, physical addresses, phone numbers and email addresses.

Cybersecurity firm Malwarebytes, which first flagged the issue, has also warned of a surge in fake password reset emails landing in users’ inboxes. The alerts were supported by screenshots shared by users on Reddit, showing password reset requests sent without any prior action by account holders.

In a statement posted on X, Malwarebytes said some Instagram users appeared to be receiving fraudulent password reset emails — a tactic commonly used in phishing attacks to trick victims into handing over login credentials.

Malwarebytes advised users to immediately change their Instagram passwords and enable additional security features, such as two-factor authentication, to reduce the risk of account takeovers.