Telegram Investigating Major Data Breach Claims
Telegram is investigating claims by a threat actor who alleges to have obtained data from 30 million users. The leaked data reportedly includes phone numbers, usernames, and user IDs.
Incident Overview
A threat actor posting on underground forums claims to have:
- 30 million user records
- Phone numbers linked to accounts
- Usernames and user IDs
- Account creation dates
- Some message metadata
Sample Data Analysis
Security researchers who reviewed the sample data noted:
- Data appears to be from multiple regions
- Most records from 2024-2025 timeframe
- No message content included
- Mix of active and inactive accounts
Telegram's Response
Telegram issued a statement:
"We are aware of the claims and are investigating. Our initial analysis suggests this data did not originate from a breach of Telegram's systems. We believe this may be aggregated data from other sources or API abuse."
Possible Sources
Researchers speculate the data could come from:
- API Abuse: Automated enumeration of phone numbers
- Third-party Apps: Compromised unofficial clients
- Data Aggregation: Combined data from multiple sources
- Insider Access: Though no evidence yet
Risk Assessment
If Authentic
Users could face:
- Targeted phishing attacks
- SIM swapping attempts
- Social engineering
- Account impersonation
- Spam and scams
Verification Challenges
- Sample represents small fraction of claimed total
- No independent verification of full dataset
- Attacker's credibility unknown
User Recommendations
Immediate Steps
- Enable 2FA: Settings > Privacy and Security > Two-Step Verification
- Review Privacy Settings: Limit who can see your phone number
- Check Active Sessions: Settings > Devices
- Be Alert: Watch for phishing attempts
Privacy Settings to Review
Settings > Privacy and Security:
- Phone Number: Nobody / My Contacts
- Last Seen: Nobody / My Contacts
- Profile Photo: My Contacts
- Forwarded Messages: Nobody
- Calls: My ContactsPrevious Telegram Security Issues
This isn't the first time Telegram has faced data concerns:
| Year | Incident | Records |
|---|---|---|
| 2020 | User database leak | 15M |
| 2022 | Account enumeration | Unknown |
| 2024 | Third-party bot breach | 2M |
| 2026 | Current investigation | 30M (claimed) |
Industry Context
Messaging platforms remain high-value targets due to:
- Large user bases
- Sensitive communications
- Authentication via phone numbers
- Value for social engineering
What Happens Next
- Telegram continues internal investigation
- Security researchers analyzing available samples
- Law enforcement likely to be involved
- Users should monitor for suspicious activity
Expert Commentary
"Even if this isn't a direct breach, the data is real and dangerous," noted a privacy researcher. "Phone number to username mapping enables targeted attacks regardless of source."
Sources: TechCrunch, BleepingComputer, Telegram Official