If you have a Instagram account and used your personal contact information when you created it you should be changing them immediately. Even though Instagram already patched the flaw there is a service on the dark web by the name of Doxagram that offers to give you account information for only $10.
The way it works according to Kaspersky Lab researchers:
“Using the outdated application the attacker selects the reset password option and captures the request using a web proxy. They then select a victim and send a request to Instagram’s server carrying the target’s unique identifier or username. The server returns a JSON response with the victim’s personal information including sensitive data such as email and phone number,” they explained.
“The attacks are quite labor intensive: each one has to be done manually since Instagram uses mathematical calculations to prevent attackers from automating the request form.”
You have been warned!