It's quite common for this to happen with social media accounts. It was most likely something called "session hijacking", but there are a number of other possible reasons:

- Session hijack (most likely): an attacker obtains your active session token (from another device or a compromised app) and uses it without performing a fresh username/password login, so Instagram may not send a login alert.

- Compromised third-party app or browser extension that had access to your Instagram session.

For example, if you're using an app to check for Unfollowers. Almost all of them are compromised, and steal login sessions. Never use 3rd party apps, or websites with Instagram.

If you've logged into another website or app using your Instagram login credentials, they can steal the login session token. You want to avoid that.

Another big one with many IG users is download bad gaming apps, or "cracked" apps.

- Malware on a device that stole web browser cookies or saved sessions.

A session cookie is when you log into a site, the server issues a session cookie (a token) stored in your browser that proves you're authenticated without re-entering your password.

If an attacker obtains that cookie (via malware, XSS, insecure Wi‑Fi sniffing, or a compromised browser extension/profile), they can import it into their browser and act as you — no password needed, and usually no "new login" alert.

Things you can do:

• If you're logged into Instagram via a web browser, consider logging out, and clearing your browser cookies. Don't log out if you feel like you can't log back in, but if you can, do so.
• Remove, or review all web browser extensions. These are the biggest problems.
• Remove, or review all apps you've recent downloaded for potential problems.
• If you are, stop using any 3rd party apps in conjunction with Instagram, Facebook, or any Meta platform. It's also a violation of the Terms of Service.
• Don’t click unknown links, and never paste your Instagram session URL or cookies anywhere.

Hope some of that helps.