Loading story…
A 44GB uncompressed dataset allegedly containing 200+ million Telegram user records was advertised on a data-leak forum, with reporting indicating it was offered on BreachForums. The exposed data is described as including names, Telegram usernames, email addresses, and phone numbers, raising the likelihood of large-scale phishing and account-takeover targeting if the data is authentic and current.
Researchers cited in coverage said they had not yet confirmed whether the information reflects a new compromise or a repackaging/aggregation of older breached data, noting that the presence of Telegram user emails (not typically publicly accessible) may indicate more than simple scraping. Separately, Russia’s telecom regulator Roskomnadzor confirmed it is throttling Telegram for alleged noncompliance with Russian law and content takedown demands; this state-imposed disruption is a policy/regulatory action and not directly tied to the alleged data-leak incident.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers warned that the exposed Telegram-related dataset could be used for large-scale phishing campaigns against users. NVISO also highlighted growing threat-actor targeting of Telegram and urged businesses to restrict use of Telegram's API.
Subsequent analysis found the exposed material appeared to include about 60 million Telegram records alongside references to 16 billion credentials, and researchers said they could not confirm it represented a new breach rather than older stolen data. They assessed the dataset was likely not purely scraped because Telegram user email addresses are not publicly accessible, suggesting a mix of scraping and previously compromised data.
A threat actor exposed or advertised a purported Telegram user dataset on BreachForums on Jan. 24, claiming it contained more than 200 million records from three databases. The uncompressed data was described as 44 GB and allegedly included names, Telegram usernames, email addresses, phone numbers, and other personal details.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered an exposed **Elasticsearch** database containing roughly **24 billion** plaintext credential records, including usernames, email addresses, passwords, and associated login URLs. The dataset was estimated at more than **8 terabytes** and appeared to aggregate data from **36 sources**, including infostealer logs, Telegram channels, prior breach collections, local database dumps, and exports from live servers. Investigators said the database was publicly accessible before being taken offline, but the owner could not be identified. The exposed records create a significant risk of **credential stuffing**, account takeover, and broader identity abuse at global scale, especially for users who do not use **multi-factor authentication**. Researchers reported that more than 30 of the sources were linked to Telegram channels and that **22.6 billion** entries were broadly labeled as “collections,” while signs of regular updates suggested the dataset was being actively curated. They also found records referencing **CVE** identifiers, GitHub links, breach news, and social media posts about incidents, indicating the operator may have been monitoring the cybersecurity landscape while maintaining the credential trove.
Jul 12, 2026
A threat actor has advertised an alleged **Revolut** customer database for sale on a cybercrime forum, claiming it contains more than **75 million records** tied to the fintech platform. Reported samples include personally identifiable information, account identifiers, device metadata, partial payment card details, and hashed credentials, raising potential risks of phishing, identity theft, and fraud if the data is authentic. Revolut said it has found **no evidence of unauthorized access** or a new compromise of its systems, and researchers have not verified the seller’s claims. Early analysis indicates the records may extend to around **May 2025**, but investigators suspect the dataset could be an aggregation of historical or unrelated leaks rather than proof of a fresh breach; both the company and outside researchers say technical evidence such as authenticated exports or forensic logs is still lacking.
Jul 30, 2026Group-IB reported that several Chinese-language dark web forums and Telegram channels are advertising massive troves of supposedly stolen corporate data that often do not represent genuine new breaches. The company identified recurring sellers and channels including **Exchange Market**, **Chang’An Sleepless Night**, **Aiqianjin**, **Yiqun Data**, and **Phoenix Overseas Resources**, saying they promote high-volume datasets from organizations worldwide using repetitive formats, aggressive messaging, and breach-related keywords to attract buyers and attention. According to the research, many of the advertised records appear to be recycled or recombined from older public leaks such as **Facebook 2021**, **Eatigo 2020**, and **Truecaller 2022**, rather than fresh exfiltration. Group-IB said sample data showed multiple signs of fabrication or poor recombination, including mistranslated Arabic field values, mismatched names, phone numbers, and password hashes, as well as implausible database structures. The firm warned that these "lead data" brokers create noise that can misdirect incident response and urged defenders to verify whether claimed records match an organization’s real schema and whether identifiers within each record are internally consistent before treating a post as evidence of compromise.
Jun 29, 2026