According to a researcher, the social media platform has leaked information including email addresses phone numbers, which was found in the source code for some user profiles.
Data scientist and business consultant David Stier discovered the issue, which saw the details included in the code whenever it was loaded in a web browser.
Although the contact information wasn't displayed on the profiles on the desktop version of the site, it was still used for communication by the photo sharing site's app.
Stier said the exposure included contact details for thousands of accounts owned by private individuals - some minors - alongside those belonging to brands and businesses.
This week, Instagram - which is owned by Facebook - has confirmed it is investigating the report of the leaky code.
Meanwhile, the app recently announced its changing their rules regarding account removals.
The photo sharing social networking site confirmed plans to roll out a new set of guidelines for banning users.
As it stands, accounts are currently allowed a "certain percentage" of violations over a period of time before they get banned, but this is weighed in a way that more prolific posters are given more leeway.
However, CNET reported that the new policy will see accounts taken down after a certain number of violations in a set time frame, which all users held to the same standard.
The company is yet to disclose the exact number of violations or the time, because Instagram doesn't want anyone to have the chance to take advantage of the guidelines.