The Facebook-owned social network has emailed verified members, usually prominent figures, to let them know.

It said it believed "one or more" attackers had targeted high-profile stars to get their contact information.

Instagram said passwords had not been stolen but warned users to watch for suspicious activity on their accounts.

However, it did not say which accounts had been affected.

The security breach was made possible due to a bug in the company's own software.

Its application programming interface (API) was at fault, it said - but added that the bug had since been fixed.

The company warned its verified users to "be extra vigilant" about unexpected phone calls, texts, and emails.

Instagram has about 700 million users worldwide, some 375 million of which use it once a day.