Belarusians' complaints to state agencies leak into a Telegram lookup bot

Complaints that Belarusians sent to government agencies through Obrashcheniya.bel, the state portal for official appeals, now show up in a Telegram lookup bot. The independent outlet Zerkalo found records labelled "users of obrashcheniya.bel" in a bot called Sherlock and checked that they were real appeals. Its report came out on the evening of October 9. On the morning of October 10 the Ministry of Communications and Informatization said access to the portal was "temporarily restricted" because of technical work. It has not mentioned a leak.

What leaked

According to Zerkalo, a search in the bot returns a person's full name, phone number and email address, for some users their national ID number, and the full text of the appeal. Dates and attached documents are missing. Zerkalo says the tools available to it cannot show how many people are affected. More than 413,000 individuals and 19,000 government bodies and organisations are registered on the portal, and since 2023 it has been the only channel for sending an electronic appeal to a Belarusian agency.

To show the data is genuine, Zerkalo published a few entries. One belongs to Sergei Belikov, director of the state-owned Digital Development Centre that built the portal, and contains a single word: "Test". He was probably one of the first users. The other examples include a thank-you note to doctors and a demand that a district newspaper retract an article.

Why a lookup bot matters

Lookup bots, known in Russian as "probiv" services, take a name or a phone number and return whatever leaked databases hold about that person: address, date of birth, photos, and now complaints. Many are run from Russia and sit in a legal grey zone: they are built on leaked databases that are resold on specialised markets, and Telegram regularly blocks them for breaking its rules. Zerkalo notes that Belarusian security officials have admitted using such bots in their work, and that fraudsters use the same data to call people and talk them into giving access to their bank accounts.

An appeal is often a complaint about an official, a neighbour or an employer. Once the text is tied to a phone number in a searchable bot, anyone with access can see who complained about what.

No official notice

Belarusian rules require an operator to report a leak to the National Personal Data Protection Centre, which publishes the largest incidents. This year it reported breaches affecting Belarusian customers of Dodo Pizza, General Leasing and Maxbet-M. It has said nothing about Obrashcheniya.bel. Zerkalo writes that this means either the portal's administrators do not know about the leak yet or they decided not to report it. The ministry's notice gives no reason for the outage and no date for restoring the service. For comparison, Sweden's regulator fined an IT supplier this year over a leak that hit one in five people in the country.

If you used the portal

• Treat calls that mention your appeal, or claim to be from an agency you wrote to, as a possible scam. Hang up and call the agency on its official number.
• Do not look yourself up in lookup bots. Zerkalo warns that their operators can log who searched for what and sell or hand over that record.
• If your personal data was misused, you can file a complaint with the National Personal Data Protection Centre.

Leaked records do not disappear once a site goes offline. The appeals are already in the bot, and closing the portal for maintenance does not take them out.