Specialists from BI.ZONE Threat Intelligence have identified a personal data database of Telegram messenger users on shadow internet resources. The dataset contains information about individuals who contacted customer support in 2025: phone numbers, account identifiers, device information, and full texts of requests sent to operators. According to analytical estimates, the database may have been distributed among a limited circle of buyers, meaning a significant portion of the affected individuals may remain unaware of the data compromise.
Cause of the Leak: The Volunteer Support Model
BI.ZONE highlights the abuse of access by Telegram customer support volunteers as the most probable cause of the incident. User requests are handled by volunteers who undergo internal selection; however, they are not bound by employment contracts with the company and do not sign Non-Disclosure Agreements (NDAs). This model creates risks of uncontrolled access to confidential information outside the corporate infrastructure: a volunteer receives full user data but bears no legal responsibility for its subsequent use or transfer to third parties.
The Threat to Users
Chat message texts are of particular value to malicious actors. The details contained within them, combined with contact information, allow attackers to prepare targeted phishing attacks against account owners, their personal and work contacts. Corporate accounts are also at risk, including those whose access was restored through customer support: an attacker knowing the request context and account identifier can mimic a legitimate request or use the information for social engineering.
BI.ZONE Recommendations for Users and Organizations
The company advises users not to transmit sensitive work information, passwords, and access codes via support chats, and to set up a Telegram cloud password to provide additional protection for their chats. Organizations are recommended to include corporate messenger accounts in the inventory of protected information assets and account for the specifics of the volunteer support model when assessing cyber threats. Experts emphasize that even with client-side chat encryption, support request metadata and query texts remain a vulnerable link if processed by individuals without strict legal restrictions.
Context: The Scale of the Volunteer Support Problem
The Telegram incident is not isolated: the model of engaging external volunteers to process user requests is widespread among technology companies and creates a systemic risk. Unlike full-time staff, volunteers do not undergo regular access audits, are not bound by corporate information security policies, and do not bear criminal or civil liability for data leaks to the same extent as employees. BI.ZONE notes that the discovered database is merely the tip of the iceberg: without public disclosure of the scale by Telegram, it is impossible to assess how many users are affected by the leak and exactly when access was compromised.
