70M Telegram Records Leaked by Namolesa on DarkForums

Data Breach Summary

A massive Telegram database leak has been published by the user “namolesa” on DarkForums.st, containing over 70 million records spanning from 2020 to 2025. This CSV dataset includes user IDs, phone numbers, usernames, first names, and last names, compromising sensitive identity information of Telegram users worldwide.

The breach exposes extensive user data collected over five years, highlighting the risks of large-scale data aggregation and scraping that can later be exploited by cybercriminals for phishing, scams, and identity fraud.

---

Where and How?

The data was found posted on DarkForums.st, a prominent underground forum used to share stolen databases and breached information. The leak was shared by the threat actor “namolesa”, who made the full CSV file public, containing detailed Telegram user profiles.

Such leaks typically originate from scraping public Telegram data, exploiting contact import features, or from compromised databases managed by third parties that store Telegram user information. The exposure of phone numbers alongside usernames significantly increases the risk of targeted attacks and social engineering.

Company Data Breach History

Previous Telegram-related breaches include:

• June 2020: Over 900MB of Telegram data leaked, exposing phone numbers and user IDs through contact export misuse.
• April 2025: A massive leak by “Naz.API” affected over 70 million accounts across multiple platforms, though Telegram was not directly listed.

This new incident is one of the largest Telegram user data exposures recorded, emphasizing the platform’s vulnerability to data scraping and the necessity for enhanced privacy safeguards.

---

Recommendations for Personal Data Protection

How Users Can Protect Their Information

• Adjust Telegram privacy settings to restrict phone number visibility.
• Enable two-factor authentication for account security.
• Change passwords on any services linked to your Telegram account.
• Be cautious of suspicious messages or calls that may result from data exposure.
• Regularly review account activity to detect any unauthorized access.

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.