Case A — You still have access to the account
Act immediately:
- change the password
- choose a completely new password
- sign out unknown sessions
- turn on or reconfigure 2FA
- check the email address on file
- check the phone number
- remove unknown third-party apps
- check whether the same old password was used elsewhere
If it was, change it on every other service concerned.
Case B — You have lost access to Instagram
Meta provides a dedicated procedure at instagram.com/hacked. Prefer that official procedure over a link received in a private message or an unexpected email.
Meta also indicates that when an Instagram email address is changed, a security message can let you reverse that change from the address originally on the account.
Case C — Your email address itself was hacked
This is the priority. You must:
- recover the mailbox
- change its password
- turn on its 2FA
- check the recovery methods
- check automatic forwarding rules if the provider allows it
- check the signed-in sessions
- then secure the accounts that depend on that address