---
title: "Telegram User Database Containing Support Requests Discovered on the Dark Web"
description: "BI.ZONE Threat Intelligence has discovered a database of Telegram users who contacted support in 2025 on the dark web. The leak includes phone numbers, account IDs, and chat texts."
date: 2026-11-13T15:58:58.413Z
lang: en
url: https://xab.info/en/posts/telegram-support-data-leak-bi-zone
tags: [telegram, data-leak, bi-zone, cybersecurity, privacy, darknet]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Telegram User Database Containing Support Requests Discovered on the Dark Web

![Smartphone with open messenger app and cybersecurity icons on a desk with laptop](https://xab.info/media/2026/11/13/telegram-support-data-leak-bi-zone/telegram-support-data-leak-bi-zone-1.webp)

## Key Points

- BI.ZONE Threat Intelligence discovered a Telegram user database on shadow resources for those who contacted support in 2025
- The dataset includes phone numbers, account IDs, device details, and request texts
- The most likely cause is access abuse by support volunteers not bound by employment contracts or NDAs
- Chat texts enable targeted phishing attacks; corporate accounts are also at risk
- BI.ZONE recommends setting up a Telegram cloud password and avoiding sharing sensitive info via support

Specialists from BI.ZONE Threat Intelligence have identified a personal data database of Telegram messenger users on shadow internet resources. The dataset contains information about individuals who contacted customer support in 2025: phone numbers, account identifiers, device information, and full texts of requests sent to operators. According to analytical estimates, the database may have been distributed among a limited circle of buyers, meaning a significant portion of the affected individuals may remain unaware of the data compromise.

### Cause of the Leak: The Volunteer Support Model

BI.ZONE highlights the abuse of access by Telegram customer support volunteers as the most probable cause of the incident. User requests are handled by volunteers who undergo internal selection; however, they are not bound by employment contracts with the company and do not sign Non-Disclosure Agreements (NDAs). This model creates risks of uncontrolled access to confidential information outside the corporate infrastructure: a volunteer receives full user data but bears no legal responsibility for its subsequent use or transfer to third parties.

### The Threat to Users

Chat message texts are of particular value to malicious actors. The details contained within them, combined with contact information, allow attackers to prepare targeted phishing attacks against account owners, their personal and work contacts. Corporate accounts are also at risk, including those whose access was restored through customer support: an attacker knowing the request context and account identifier can mimic a legitimate request or use the information for social engineering.

### BI.ZONE Recommendations for Users and Organizations

The company advises users not to transmit sensitive work information, passwords, and access codes via support chats, and to set up a Telegram cloud password to provide additional protection for their chats. Organizations are recommended to include corporate messenger accounts in the inventory of protected information assets and account for the specifics of the volunteer support model when assessing cyber threats. Experts emphasize that even with client-side chat encryption, support request metadata and query texts remain a vulnerable link if processed by individuals without strict legal restrictions.

### Context: The Scale of the Volunteer Support Problem

The Telegram incident is not isolated: the model of engaging external volunteers to process user requests is widespread among technology companies and creates a systemic risk. Unlike full-time staff, volunteers do not undergo regular access audits, are not bound by corporate information security policies, and do not bear criminal or civil liability for data leaks to the same extent as employees. BI.ZONE notes that the discovered database is merely the tip of the iceberg: without public disclosure of the scale by Telegram, it is impossible to assess how many users are affected by the leak and exactly when access was compromised.

## Fact-Check & Sources

- [Личные данные пользователей Telegram утекли через службу поддержки](https://www.ixbt.com/news/2026/11/13/licnye-dannye-polzovatelei-telegram-utekli-cerez-sluzbu-podderzki.html) - Primary source: BI.ZONE Threat Intelligence report. The fact of database discovery is confirmed; the leak cause is stated as 'most probable' and not confirmed by Telegram. The scale of the leak has not been disclosed.
- [Данные почти всех жителей Казахстана утекли в даркнет](https://www.infox.ru/news/251/384427-dannye-pocti-vseh-zitelej-kazahstana-utekli-v-darknet) - Describes a different leak (eGov state portal, 15 million citizens of Kazakhstan, hacker shymzz13). Not related to the Telegram incident and not included in the article text.

## FAQ

### What specific Telegram user data was leaked?

According to BI.ZONE, the database includes phone numbers, account identifiers, device details, and full texts of requests sent by users to customer support in 2025.

### Why could support volunteers be the cause of the leak?

Volunteers handle requests but are not bound by employment contracts or NDAs with Telegram. This means they do not carry the same legal responsibility for transferring data to third parties as regular employees.

### What should I do if I contacted Telegram support in 2025?

BI.ZONE recommends setting up a Telegram cloud password, and avoiding sharing passwords, access codes, and sensitive work info via support chats. Organizations are advised to include corporate accounts in protected assets.

### Has Telegram confirmed the leak itself?

There is no public comment from Telegram regarding this incident in the provided materials. The discovery of the database has been confirmed by BI.Zones Threat Intelligence analysts.