Bottom line: The combination of phone numbers, usernames and partial real names enables targeted phishing campaigns, including on other platforms.
An anonymous actor is offering a file with alleged data from 182 million Telegram users on the darknet. Security researchers confirm the authenticity of samples, which predominantly contain Russian-language profiles.
An unknown seller is offering a compressed file of 41.1 gigabytes for sale in an underground forum, which according to his claims contains 182 million Telegram user data. As proof, the seller published a sample of 60 datasets. Security researchers from Cybernews verified this sample and confirmed its authenticity; it consists predominantly of Russian-language profiles. It remains unclear whether the data leaked directly from Telegram through a security vulnerability or whether it is an aggregation of already compromised datasets from Russian online services and public Telegram channels.
The offered datasets contain usernames, phone numbers, internal Telegram user IDs and in many cases real names. While this information is insufficient to take over accounts, it forms an effective attack tool for fraudsters. With the combination of the actual phone number and the associated username, attackers can create personalised phishing messages in which they pose as Telegram support or representatives of cryptocurrency exchanges and pressure users to disclose passwords or authentication codes.
Users in public forums such as Reddit are already reporting targeted attacks. Many describe SMS messages allegedly from Telegram warning of imminent account lockout. At the same time, users document fraud attempts in which attackers copy the names and profile pictures of group administrators and request members to verify crypto wallets via direct message. The stolen phone numbers also enable attackers to target users on other platforms such as WhatsApp or link the data with material from previous security incidents to conduct even more precise attacks.
Source: www.it-daily.net · Published 14 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.