Messages people sent to Telegram support in 2025 are being sold online, researchers say
A database of messages that Telegram users sent to the app's support team in 2025 is being sold on underground forums, Russian security company BI.ZONE says. According to CNews, which received the findings from BI.ZONE Threat Intelligence, the records include phone numbers, account IDs, device details and the full text of support requests. How many users are affected has not been disclosed, and Telegram has not commented.
In short
- Only people who wrote to Telegram support in 2025 are affected, not all Telegram users.
- BI.ZONE thinks the data most likely came from support volunteers misusing their access. This is the company's assumption, not a confirmed fact.
- The researchers believe the database was sold to a small circle of buyers, so victims may never find out.
Why volunteers are in the picture
Telegram does not hide that its support is run by volunteers. Its FAQ says "we rely on volunteers for support" and invites people to apply. When a user opens Settings and taps Ask a Question, the chat goes to these volunteers. BI.ZONE notes that they pass a questionnaire and a selection process but have no employment contract with Telegram and no confidentiality agreement. In the company's view, that makes leaks through misused access the most likely explanation.
What attackers can do with support messages
Phone numbers and account IDs leak often. What makes this set different is the text of the requests. People write to support when they have lost access, see a strange login or are trying to recover a business account, and they often describe the situation in detail. "Combined with the account ID, phone number and device model, the texts give enough data to prepare a targeted attack," Oleg Skulkin, head of BI.ZONE Threat Intelligence, told CNews.
In practice, a scammer who knows that you asked for help with a hacked account in March can write to you as "Telegram support" and refer to that request. Such a message is far more convincing than generic phishing. BI.ZONE adds that company representatives who restored access to business accounts in 2025 are also at risk.
What to do
- Turn on a cloud password: Settings > Privacy and Security > Two-Step Verification. Then a stolen login code alone will not be enough to take over your account.
- Do not trust messages from "support" that mention your past request. Telegram says it will never ask for your two-step verification password or login codes.
- Do not put passwords, codes, bank details or work information in support requests. Assume the text could be read by someone else.
- If you run company accounts in Telegram, BI.ZONE advises treating them as important assets with a named owner and restoring access through your own security team rather than through public support.
What Telegram itself hands over to the authorities is a separate story: we wrote about a Telegram letter in a US court that showed what the messenger gives investigators.
