Your inbox chimes. An email from Instagram appears, bearing all the official hallmarks of authenticity—the verified domain, the proper formatting, the security@mail.instagram.com sender address.

The personal details of hundreds of thousands of people may have been stolen in a cyber attack on a west London council. Kensington and Chelsea Council has written to warn households that criminals ...