Telegram's letter in a US court shows what it hands to investigators

A letter from Telegram to US investigators has been filed in a federal court in Louisiana, and it shows exactly what the messenger hands over when it answers a law enforcement request: the account's user ID, its phone number, the name on the account, and the IP address of the last login with a timestamp. The letter, dated 4 September 2026, was filed on 15 October as an exhibit in the case against Mahmoud Amin Ya'qub Al-Muhtadi, and 404 Media reported on it on 16 October. Telegram says in the letter that it provided the data "voluntarily".

What the letter contains

Al-Muhtadi, 33, lives in Lafayette, Louisiana. The US Justice Department arrested him in October 2025 and accuses him of taking part in the 7 October 2023 attack on Israel and of lying on his US visa application. According to 404 Media, investigators obtained a court order under the Stored Communications Act and sent it to Telegram.

Telegram's reply takes up a few lines. It gives one user ID, one phone number with the name shown on the account, and one IP address with a login time of 8 October 2025. A note at the end explains that timestamps are in UTC and "reflect the last login time of the account in question". The letter does not include any messages, contacts or lists of chats, and it says nothing about whether investigators asked for them.

A legal statement takes up most of the page. Telegram writes that it is "voluntarily providing this reply" and that in doing so it is "not conceding that we are subject to U.S. jurisdiction for this or any other request". It also says the reply may not be "a full and complete response" and that it is not committing to provide anything more.

The line about extra logging

The most telling part is a short "note on data availability". Telegram writes that because of its technical structure, a phone number is "generally required" to look up a user's private data. But a username or a Telegram ID can also work, "such as in cases when additional logging could be enabled following an official data disclosure request or if the account in question has been previously subject to moderation". Read plainly, this means that once a request arrives, Telegram may start recording more about an account than before, and that accounts it has already moderated are easier to find.

Telegram used to say this never happened

Until September 2024, Telegram's privacy policy said it could disclose an IP address and phone number only if a court confirmed that the user was a terror suspect, and added: "So far, this has never happened." After French authorities detained Pavel Durov in August 2024, the company rewrote the rule to cover suspects in any criminal case that breaks its terms of service. Disclosures rose after that. Telegram's own transparency bot told 404 Media that from January to September 2024 the company fulfilled 14 US requests affecting 108 users, and for the full year 900 requests affecting 2,253 users.

The new letter adds a concrete example to those numbers. It shows that a Telegram account in a US investigation can be tied to a real phone number, a name and the place it last connected from.

What this means for users

Two pieces of data in the letter link an account to a person: the phone number, which is tied to a SIM card, and the IP address of the last login. A VPN changes only the second one. Telegram then sees the VPN server's address, not the user's home or mobile connection. It does nothing for the phone number, which Telegram requires for every account.