On: Instagram data breach 49M users’ sensitive data exposed online

[asymptotically2]

A TechCrunch article[0] suggests that all of this information was just scraped from the Instagram site/API, so is it fair to call this "sensitive" data if it's available to the public anyway?

[0]: https://techcrunch.com/2019/05/20/instagram-influencer-celeb...

[wiz21c → asymptotically2]

same article says :

>>> but also contained their private contact information, such as the Instagram account owner’s email address and phone number.

I doubt this is "scrapable".

[mfatica → wiz21c]

It is actually, if you go to instagram's website and view source, there's a script tag containing a massive JSON payload with the response from their graphql API which contains allllll the data for the page - this includes some information that's not displayed on the page, which sometimes includes email address and phone number. I had to scrape instagram for a school project and stumbled upon this - I was planning to parse the html but if you just take out that script tag as a JSON object you have all the page's data in an object for you already.

[hughstephens → wiz21c]

It's hard to say – most Instagram influencers provide a public contact email +/- phone number for "business enquiries".

Could be that the data that is listed was previously on the profile but not currently (or matched from another service) vs acquired directly.