If your Instagram profile changed by itself, strange DMs went out, or your password suddenly fails, treat the account as compromised. The priority is to remove the intruder, restore the profile, and make sure they cannot get back in through an old session or connected app.
Does this affect you?
Use this for personal and creator Instagram accounts in the app or on the web. A hacked account may still let you sign in, or it may be fully locked because the attacker changed the password, email, or phone number.
If you can still log in
Do these steps immediately, before the attacker changes more settings.
- Open Instagram and go to Settings and privacy > Accounts Center > Password and security. Older app versions may show this under Settings > Security.
- Choose Change password and set a new password you do not use on any other site.
- Open Where you’re logged in or Login activity and review every session.
- Log out any device, browser, or location you do not recognize.
- Open Apps and websites and remove anything unfamiliar, especially follower tools, analytics tools, or apps you did not authorize.
- Go to Edit Profile and restore the username, bio, profile picture, links, and other details if they were changed.
- Turn on two-factor authentication under Accounts Center > Password and security.
If you are locked out
Use Instagram’s account recovery flow instead of trying old passwords repeatedly.
- On the Instagram login screen, tap Get help logging in, or open instagram.com/hacked in a browser.
- Enter your username, email address, or phone number.
- Follow the prompts for a login link or recovery code if Instagram can still reach one of your contact methods.
- If the attacker changed the email and phone number, follow the prompts for identity verification. Instagram may ask account questions or request a short video selfie so it can compare you with profile photos.
- Submit the request and watch your email, including spam, for next steps. Processing can take minutes or several days.
- After access is restored, immediately complete the sign-out, app removal, password change, and two-factor steps above.
More control
Report the compromise
Even if you regain access another way, instagram.com/hacked is useful because it tells Instagram the account was compromised. That can help reverse suspicious changes such as a swapped recovery email.
Warn people if scams were sent
If the intruder posted stories, sent DMs, or left comments with scam links, make a short public update telling followers to ignore recent messages. This limits the damage while Instagram catches up.
Check linked Facebook access
If Instagram and Facebook are connected in Accounts Center, secure Facebook too. Attackers often move between linked Meta accounts when one password is weak or reused.
Turn on login alerts
In Accounts Center > Password and security > Login alerts, enable alerts for new device or location sign-ins so you notice the next suspicious attempt right away.
Sources
- Instagram Help Center – My Instagram account has been hacked (2025)
- Instagram Help Center – What to do if you think your account was hacked (2025)
- Instagram Help Center – How to secure a compromised account (2025)