A low-reputation account on an underground data-leak forum is advertising a 120-million-row Telegram-related corpus dominated by Iranian and Russian phone numbers. A forensic read of the sales thread, its schema, its country ledger, its arithmetic, points to compilation, contact enumeration and recycling rather than a fresh intrusion into Telegram’s infrastructure. That distinction matters for Telegram as a company; for the humans whose numbers, names and user IDs sit in those rows, the risk is real either way.
Key takeaways
- The listing advertises more than 120 million rows containing phone numbers, Telegram user IDs, first and last names, nicknames, usernames and, where available, email addresses, with Iran (66,721,760 rows) and Russia (14,801,939 rows) topping the seller’s own country ledger.
- Nothing in the schema, no passwords, no session tokens, no message content, supports a server-side Telegram breach claim; the structure of the thread is consistent with aggregated scraping, contact-discovery enumeration and recycled historical dumps.
- The dataset is internally inconsistent: duplicate country rows, mixed digit-grouping conventions, leftover ETL artifacts and a per-row
sourcecolumn all indicate a hand-stitched compilation, and the headline totals should be treated as marketing, not measurement. - Exposure is still operationally serious. Phone-to-identity mappings of this scale fuel SIM-swap targeting, SMS phishing waves, admin-impersonation scams and, for users in authoritarian jurisdictions, state-grade identification. Concrete hardening steps are provided at the end of this analysis.
Inside the sales thread
The advertisement is blunt even by underground standards. Under a purple, BreachForums-family forum skin, a thread titled “Telegram most 120 MILION RECORDS (PHONE|ID|FIRSTNAME|LASTNAME ETC)” promises a “World-wide data base for all countries you can find here!” The seller’s résumé is thin for someone moving one of the year’s largest claimed corpora: joined April 2025, thirteen posts, two threads, reputation score of three. The schema is pasted into the post with raw HTML tags still attached, <h3>country_code,actors,number,security,phone,first_name,last_name,nick,user_id,email,name,username,source</h3>, which at least tells analysts exactly what columns buyers are being offered.
Beneath the schema sits the thread’s most interesting artifact: a per-country ledger of record counts, reproduced below as displayed in the listing.
| Country / label | Rows claimed |
|---|---|
| Iran | 66,721,760 |
| Russia | 14,801,939 |
| Uzbekistan | 6,23,501 (sic) |
| Kazakhstan | 1,901,493 |
| Ukraine | 1,322,000 |
| Belarus | 1,151,597 |
| Turkey | 604,618 |
| India | 455,553 |
| Indonesia | 322,617 |
| Malaysia | 290,925 |
| Iraq | 204,878 |
| Brazil | 186,345 |
| Indonesia (duplicate row) | 150,501 |
| Unknown (100) | 138,649 |
| Kyrgyzstan | 131,385 |
| United States | 129,932 |
| Malaysia (duplicate row) | 93,814 |
| Ethiopia | 65,141 |
| No reason (0) | 59,995 |
| Pakistan | 52,901 |
| Egypt | 44,867 |
Read carefully, the ledger undermines the very claim it exists to support. The twenty-one visible rows sum to 89,454,411 records, leaving roughly thirty million to rows truncated below the fold, plausible enough for a “120M” headline, but unverifiable from the post itself. Indonesia and Malaysia each appear twice with different counts, which is what concatenated extracts look like before anyone has bothered to deduplicate them. The Uzbekistan row, listed as 6,23,501, uses Indian-style digit grouping while its neighbors use Western grouping, and labels such as “Unknown (100)” and “No reason (0)” are classic ETL debris carried over from a spreadsheet or SQL export. Early summaries circulating alongside the listing cited approximately 46.7 million Iranian and 14.6 million Russian rows, against the thread’s own 66,721,760 and 14,801,939, a gap nobody has reconciled.
Then there is the Iranian figure itself. Sixty-six million rows attributed to a single country is difficult to square with any credible count of unique Iranian Telegram accounts; it is far more consistent with whole number-range enumeration, which sweeps inactive and unregistered lines alongside live ones, or with the merger of several historical Iranian dumps, including the 42-million-record Elasticsearch exposure tied to unofficial Iranian Telegram clients in 2020. The pattern rhymes with earlier mega-listings: a 44 GB dump posted on January 24 and widely re-covered in February 2026 claimed over 200 million Telegram-linked records and yielded roughly 66 million phone-number-to-user-ID pairs on sample review, a number suspiciously close to this thread’s Iranian row. Breach chronologies date that original dump to January 2025. In July 2026, Cybernews examined a separate 41.1 GB file advertised as 182 million records and found samples skewed to Russian-speaking users, suggesting collection from Russian-language services and channels rather than a single source. The 120-million thread is best understood as the latest iteration of this conveyor belt: overlapping corpora, re-counted, re-labeled and re-priced.
Breach or compilation? Reading the provenance signals
What a real Telegram breach would look like
A genuine server-side exfiltration of Telegram’s user database would almost certainly carry authentication material: password hashes or cloud-password verifiers, session tokens, server-stored cloud-chat content, or infrastructure logs. The advertised schema contains none of these. It is an identity-mapping table (numbers, names, IDs, handles, some emails) which is precisely the shape produced by client-side collection techniques that never touch Telegram’s servers at all. Telegram has, to date, never confirmed a mass server-side exfiltration; every major “Telegram breach” on record has resolved into scraping, third-party application failures or aggregation. The 2016 incident that exposed 15 million Iranian users’ phone numbers involved account compromises and interception rather than a platform breach. The 2020 Iranian dataset sat in an unpassworded Elasticsearch cluster fed by bootleg clients. Telegram’s standing explanation for the 2025-era mega-dumps was that the records were a byproduct of its contact-importing feature, not an intrusion.
The enumeration engine: contact discovery as an oracle
The workhorse behind datasets like this is a feature, not an exploit. Telegram’s contact discovery lets any client upload a batch of phone numbers and receive back every match’s registered status, display name, username, profile photo, bio, last-seen status and permanent numeric user ID. The mechanism scales industrially: the MTProto API exposes contacts.importContacts directly to libraries such as Telethon and TDLib, and operators who prefer not to touch the API at all inject contacts into Android emulators via ADB and let the stock client sync for them. A single account syncs on the order of 5,000 contacts before it needs rotation, aged accounts enjoy looser rate limits than fresh ones, and slow-drip imports evade cooldowns, so a farm of a hundred burner accounts puts country-scale enumeration within reach. Telegram performs this matching in plaintext on its servers, unlike Signal’s enclave-based private contact discovery, which makes mass enumeration computationally impractical by design. The technique is old and well documented: industrial scraping campaigns against the contact-discovery API were observed as early as 2019, and by 2020 a bot operating on Telegram itself was selling lookups against a database of more than 500 million phone-to-user-ID mappings.
The aggregation tells: a source column is a confession
The single most diagnostic field in the schema is the last one. A source column means each row carries a provenance tag, which only makes sense if the table was assembled from multiple inputs by an ETL pipeline. Duplicate country rows, inconsistent number formatting and stray labels like “No reason (0)” corroborate that reading. So does the email field: email addresses are not returned by contact discovery and are not exposed through Telegram’s public interface, so their presence implies enrichment from third-party breaches, caller-ID applications whose own leaks paired names with numbers at scale, regional service breaches, or credential dumps in which the same phone number appeared. The undefined columns deepen the picture. If security encodes something like two-step-verification status, that attribute is not observable through enumeration at all, which would imply yet another input class, such as harvested session data or a compromised third-party client. The thread is selling a merge, not a breach.
Dating the dump: user IDs as a clock
Telegram assigns user IDs roughly sequentially, which turns the ID space into a coarse registration calendar; public reference-point datasets allow researchers to estimate an account’s creation year from its ID alone. A competent buyer, or journalist, should histogram the user_id column of any sample: a corpus whose IDs cluster in old cohorts and contain few recently minted accounts is an old scrape being resold as fresh. The corresponding freshness test is simple to demand and hard to fake: rows for accounts registered within the last thirty to sixty days. Listings of this family rarely survive it.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →What each field enables
Individually, most columns are semi-public trivia. Combined, they collapse the anonymity that many Telegram users believe they have.
Field What it is Primary abuse utility country_code, phoneITU dial code plus MSISDN SIM-swap targeting, SMS OTP interception, cross-platform lookups on WhatsApp and Signal, caller-ID enrichment first_name, last_name, name, nickProfile or enriched names Phishing personalization, identity documentation, doxxing user_idPermanent, unchangeable Telegram identifier Persistent tracking across name, number and username changes; social-graph pivots via shared groups usernamePublic @handle Direct contact on-platform; cross-platform handle-reuse correlation emailPresent on a subset Credential stuffing against other services using previously breached passwords; targeted phishing sourcePer-row provenance tag For defenders: attribution of rows to constituent breaches actors, number, securityUndefined by the seller Unknown; treat any inferred meaning, including 2FA status, as unverified
The user_id matters most because it is the one value a victim cannot rotate. Change your number, your name, your handle and your photo, and the ID follows the account for life, anchoring every future lookup to every past one.
From dataset to damage: realistic abuse scenarios
The most immediate threat is to the SMS channel. A confirmed phone-to-Telegram mapping tells an attacker which numbers are worth attacking, and the names attached make the lure credible; users have already reported waves of SMS messages claiming their Telegram account will be blocked unless “verified” through a link. Pair that with a successful SIM swap and every SMS one-time password on the victim’s banking, email and exchange accounts reroutes to the attacker. A second, already-observed pattern is impersonation at scale: scammers copy a group admin’s display name and profile photo, both obtainable per match during enumeration, and message members asking them to “verify” a wallet or click a link.
The geopolitical makeup of this dataset raises a darker concern. With two-thirds of the visible ledger attributed to Iran and substantial cohorts from Russia, Belarus and Ukraine, the corpus doubles as a surveillance aid. Contact discovery has long been used by authoritarian governments to confirm which phone numbers belong to opposition Telegram accounts, and by stalkers and investigators for the same underlying reason; a pre-built ledger simply removes the enumeration step. It also sits against a changed policy backdrop: since 2024, Telegram has committed to disclosing IP addresses and phone numbers in response to valid legal requests, and fulfilled data requests covering thousands of users for U.S. authorities alone in a single year. Finally, the email-bearing subset feeds the broader credential economy: addresses can be stuffed against other services using passwords from older breaches, and history shows the pipeline runs in both directions. Have I Been Pwned’s May 2024 “Telegram combolists” entry indexed 361 million unique email addresses harvested from malicious Telegram channels.
How to check your exposure and harden your account
Start with the free public checks: search your email address and your number in international format on Have I Been Pwned, understanding that a clean result only means your data is not in an indexed breach, not that it is not circulating privately. Then change the settings that actually matter, in this order. First, set Settings → Privacy and Security → Phone Number so that nobody can see your number, and restrict “Who can find me by my number” to the most restrictive option available; this is the one control that breaks the contact-discovery oracle, because your account stops being returned as a match for your number. Second, enable two-step verification with a long, unique cloud password and a recovery email you control; this is what stands between an attacker and your account if your SMS codes are ever intercepted or your SIM is swapped. Third, audit Active Sessions and terminate anything unfamiliar, then tighten profile photo, last-seen, forwarding and group-add permissions to deny impersonators their raw material. Fourth, call your mobile carrier and set a port-freeze or SIM-swap PIN, and migrate your other critical services from SMS one-time codes to authenticator apps or passkeys. High-risk users, journalists, activists, opposition figures, should consider registering with a Fragment anonymous number or a burner SIM so that no enumerable number is tied to the identity at all.
Two things won’t change no matter what you do: disabling contact sync on your own device stops you from uploading your contacts but does nothing to stop strangers from uploading your number, and deleting your account severs future linkage but removes nothing from copies already in circulation. Treat every unsolicited message with discipline: Telegram support will never ask you for a login code, and after the January 2026 disclosure of a one-click IP leak via disguised t.me/proxy links, long-pressing any link to inspect its raw URL before tapping is a sensible habit.
Guidance for security teams
Treat this listing as an exposure event, not a breach event, and act accordingly. Monitor underground feeds for sample files, then match customer and employee records against them; the source column, if populated in samples, is free attribution intelligence telling you which constituent breach your rows came from. Notification analysis should follow the data’s origin: a dataset assembled from public enumeration and third-party breaches generally does not make your organization the source of a reportable breach, but rows that trace back to your own systems start regulatory clocks and warrant counsel involvement. In the interim, move exposed cohorts off SMS-based authentication, brief staff that dataset-driven phishing is likely to reference their real names and Telegram handles, and weigh whether your organization has an operational need for Telegram at all. Some consultancies now recommend blocking its API where no essential business use exists.
How we analyzed this listing
Our analysis is based on the listing screenshot itself, including a recomputation of the visible country ledger (89,454,411 rows across twenty-one lines), the schema as posted, and cross-referencing against public reporting and prior enumeration research cited throughout. We did not purchase, download or query the advertised dataset, and we deliberately do not link to the sales thread; readers should treat any site offering “the 120M Telegram database” as a malware or scam vector, since trojanized dumps are a standard distribution technique on these forums.
Frequently asked questions
Was Telegram hacked? There is no evidence of it. The advertised fields contain no passwords, session tokens or message content, and the dataset’s structure (a per-row source column, duplicate country rows, email addresses that Telegram’s interfaces do not expose) matches aggregation of scraped, enumerated and previously breached data rather than server-side exfiltration.
How do I know if I’m in the 120 million dataset? Search your email and phone number on Have I Been Pwned and, if available to you, dark-web monitoring services, and watch for dataset-specific phishing that references your real name or Telegram handle. Absence from indexed breach databases is reassuring but not conclusive, because private forum copies are never fully indexed.
Will deleting my account or changing my username remove me from the leak? No. Copies of compiled datasets persist across forums, channels and file hosts indefinitely; deletion only prevents new linkage going forward. Changing your username breaks future handle correlation but leaves historical rows unchanged.
Does two-step verification help if my phone number is already leaked? Yes, substantially. It adds a password layer between an attacker who controls your SMS channel, via phishing or SIM swap, and your account, and it is the single highest-value control in this scenario.
Why does Iran dominate the dataset? Iran is one of Telegram’s largest markets and has suffered repeated country-scale exposures, including the 2020 leak of 42 million records from unofficial Iranian clients. A 66.7-million-row Iranian cohort nonetheless exceeds plausible unique-user counts, indicating number-range enumeration, duplication and recycled dumps rather than a census of live accounts.
The bottom line
The “120 million Telegram records” listing is almost certainly not a breach of Telegram, and almost certainly a genuine hazard for the people inside it. It is the latest commercial packaging of a data class that has been accumulating since at least 2019: phone-number-to-identity mappings produced by a contact-discovery feature that was designed to help you find friends and turned out to help everyone else find you. For platform watchers, the story is a reminder that Telegram’s most consequential privacy weakness has never been its cryptography but its identifiers. For the roughly nine hundred million to one billion people who use the app, the actionable lesson is narrower and more useful: hide your number, lock your sessions behind a cloud password, freeze your SIM, and assume that anything you have ever synced to a contact list is already somebody’s spreadsheet.
