I tried to be careful so used Lastpass to generate and store my passwords. I just checked on grc.com/haystack and the password used had a search space size of 4.45 x 10^31 (or a "Massive cracking array" would take "1.41 hundred million centuries"). The account email was in the format [unique string]@mydomain.com.
I use Gmail for my email and it doesn't look like my account has been accessed by anything suspicious. I live/work in the middle of nowhere (literally fields all around) so stealing tokens over my wifi seems unlikely. I use iOS devices and have only ever accessed Instagram on Chrome a couple of times.
I've reported it to Instagram but my question to HN is how could this have happened? What else should I look for to check other areas of my digital life haven't been compromised?
