Telegram Security Incidents, Data Leaks and Privacy Controversies: A Timeline (2016-2026)

We count 13 notable security incidents, flaws and privacy controversies involving Telegram between 2016 and November 2026. The largest data exposure, about 42 million Iranian records in 2020, came from unofficial Telegram forks rather than Telegram's own systems. No incident on record has exposed message content from Telegram's servers at scale; the only confirmed access to messages came in 2016, when attackers took over more than a dozen Iranian accounts by intercepting SMS login codes.

Most of Telegram's problems fall into three groups: ways to link phone numbers, IP addresses or locations to accounts; bugs in the client apps; and legal and policy questions about what Telegram hands to governments. Because regular Telegram chats are not end-to-end encrypted (see is Telegram end-to-end encrypted?), Telegram's servers hold readable copies of them, which is why the policy questions matter as much as the bugs.

Telegram Security Incident Timeline (2016-2026)

Sources: Telegram's blog, ESET Research, Royal Holloway and ETH Zurich, Comparitech, the Zero Day Initiative, CVE records, and reporting by Reuters, TechCrunch, BleepingComputer, 404 Media, OCCRP and IStories. Full list in Sources & References.

In short: only the 2016 account takeovers were a compromise of Telegram accounts, and even those went through mobile carriers' SMS rather than Telegram's servers. The 2020 dump came from third-party apps. Everything else is a flaw that was found and (mostly) fixed, or a legal and policy issue.

2016: Iranian Account Takeovers and 15 Million Phone Numbers

In August 2016, security researchers Collin Anderson and Claudio Guarnieri told Reuters that an Iranian hacking group known as Rocket Kitten had taken over more than a dozen Telegram accounts and identified the phone numbers of about 15 million Iranian users. The takeovers worked by intercepting the SMS verification codes Telegram sends at login, which let the attackers add their own device to a victim's account and read their cloud chats. The researchers said this looked like it involved cooperation from a mobile carrier.

The phone numbers came from Telegram's contact-checking API: upload a number and Telegram says whether it has an account. Telegram's response on its blog was that only publicly available data was collected, that "such mass checks are no longer possible because of limitations introduced into our API earlier in 2016," and that users who think their carrier may intercept SMS codes should turn on 2-Step Verification, which adds a password to login.

2019: Hong Kong Protesters and Contact Matching

During the 2019 Hong Kong protests, engineers posting on the LIHKG forum showed that anyone could load thousands of phone numbers into a phone's contacts, sync them with Telegram, and then see which members of a large protest group matched those numbers, even if those members had hidden their number. On 31 August 2019 Reuters reported that Telegram had seen evidence that authorities may have uploaded numbers this way, though it could not confirm whether anyone was identified.

On 5 September 2019 Telegram added a "Who Can Find Me By My Number" setting. Set to "My Contacts", strangers who add your number can no longer match it to your profile. This was a design flaw rather than a breach, and the fix is opt-in: the default still lets anyone with your number find you.

2020: 42 Million Iranian Records from Unofficial Forks

In March 2020, Comparitech and researcher Bob Diachenko found an Elasticsearch database exposed on the internet with more than 42 million records of Iranian users: account IDs, usernames, phone numbers, and hashes and secret keys. It was indexed on 15 March, reported to the hosting provider on 24 March and removed on 25 March, by which time it had also been posted to a hacker forum. Comparitech reported that a group calling itself "Hunting system" had posted the data to the database.

Telegram's official app was blocked in Iran, and many people used unofficial versions built from Telegram's open-source code. Telegram told Comparitech: "We can confirm that the data seems to have originated from third-party forks extracting user contacts," adding that the exposed hashes and keys can't be used to access accounts and urging people to use official apps "that support verifiable builds." This was a third-party leak, not a breach of Telegram's servers. Who built the forks that collected the data was not established.

2021-2024: People Nearby and Location Exposure

People Nearby showed other Telegram users close to you, with an approximate distance. In January 2021 researcher Ahmed Hassan showed that by faking his phone's GPS position and reading distances from three points, he could trilaterate users' locations closely enough to find home addresses. Telegram told The Register: "Users in the People Nearby section intentionally share their location, and this feature is disabled by default," and "It's expected that determining the exact location is possible under certain conditions."

A 2023 paper, "Watch Nearby!" (published at ACM WiSec 2024), measured the feature worldwide and found the real privacy radius was always smaller than the 500 metres Telegram stated: between about 400 metres near the equator and 128 metres near the poles. Telegram updated its FAQ after the authors' disclosure. In September 2024 Durov announced People Nearby was being removed, citing bots and scammers, to be replaced by a "Businesses Nearby" feature.

2021: Four Attacks on MTProto

In July 2021 Martin Albrecht and Lenka Mareková (Royal Holloway, University of London) with Kenneth Paterson and Igors Stepanovs (ETH Zurich) published "Four Attacks and a Proof for Telegram", a formal analysis of MTProto 2.0, the protocol that encrypts traffic between Telegram apps and its servers. They found:

• a network attacker could reorder messages sent from a client to the server;
• an attacker could learn whether certain encrypted acknowledgement messages had been sent, mostly of theoretical interest;
• code in the Android, iOS and Desktop apps could in principle leak some plaintext, but only after millions of crafted messages;
• an attacker could impersonate the server during initial key negotiation, but only by sending billions of messages within minutes.

They reported the issues on 16 April 2021. Telegram fixed them in Android 7.8.1, iOS 7.8.3 and Desktop 2.8.8 plus server-side changes, and paid a bug bounty. The researchers said that "for most users, the immediate risk is low," and that with their suggested changes MTProto can provide a confidential, integrity-protected channel. These were vulnerabilities, with no known exploitation.

2024: The EvilVideo Exploit on Android

On 6 June 2024 a seller on an underground forum advertised an exploit for Telegram for Android. ESET researcher Lukas Stefanko found that it let an attacker send an Android app disguised as a 30-second video in a chat, group or channel. When the recipient tried to play it, Telegram offered an external player; tapping "Open" led to a prompt to install the app, which ESET's sample showed was spyware.

ESET reported it on 26 June and again on 4 July, when Telegram replied. Telegram fixed it in Android version 10.14.5 on 11 July 2024; versions 10.14.4 and older were affected, and Telegram Web and Desktop were not. The attack still needed the victim to agree to install an app from an unknown source.

2024-2025: Durov's Arrest and Data Sharing with Authorities

French police arrested Telegram's founder and CEO Pavel Durov at Le Bourget airport on 24 August 2024. On 28 August a judge placed him under formal investigation on all the charges he was arrested over, Reuters reported, including suspected complicity in running a platform used for illegal transactions, child sexual abuse material, drug trafficking and fraud, refusing to provide information to authorities, money laundering and providing cryptographic services to criminals. Paris prosecutor Laure Beccuau cited Telegram's "almost total lack of response" to judicial requests. Telegram said it complies with EU law and that it is "absurd to claim that a platform or its owner are responsible for abuse of that platform." Formal investigation is not a conviction. In November 2025 French judges lifted his travel restrictions, and the investigation was still open in the latest reports we could find.

On 23 September 2024 Durov announced updated terms and privacy policy: Telegram may disclose a user's IP address and phone number to authorities in response to valid legal requests concerning criminal activity, with disclosures reported in a periodic transparency report. Before, the policy mentioned only terrorism cases. Durov has said that Telegram "has never disclosed a single byte of private messages."

The figures rose sharply. Telegram's transparency data for 2024, reported by TechCrunch, showed it gave phone numbers and IP addresses to US authorities on 900 occasions affecting 2,253 users, and to Indian authorities on 14,641 occasions affecting 23,535 users. For the first three months of 2025 alone, 404 Media reported that Telegram provided data on 22,777 users worldwide, up from 5,826 in the same period of 2024, including 1,664 in the US. These are legal and policy matters, not breaches, but they change what a Telegram account can reveal about you.

2025-2026: The Unencrypted Device Identifier

In June 2025 OCCRP and the Russian outlet IStories published an investigation into the company that maintains much of Telegram's network infrastructure. On the technical side, they reported that every MTProto message carries an auth_key_id in the clear, which security specialist Michał Woźniak said "makes it possible to identify a specific user device" to anyone who can watch network traffic. IStories wrote that there was "no evidence" the infrastructure company had worked with any government or provided any data.

In May 2026 IStories reported that a review by Symbolic Software, which it found in court filings, called the core technical claims "accurate and reproducible": on unencrypted TCP connections, the identifier is sent in cleartext or trivially obfuscated form and stays the same across networks and locations. Telegram rejected the conclusions, saying the identifier changes regularly and reveals no message content, recipients or user information. This is a disputed metadata finding; it does not let anyone read messages.

2026: IP Leaks and App Vulnerabilities

One-tap proxy links (January 2026)

Researchers showed that a t.me/proxy link disguised as an ordinary @username makes Telegram for Android and iOS test-connect to the attacker's proxy as soon as it is tapped, revealing the user's real IP address, even when a VPN or proxy is configured, per BleepingComputer. Telegram said "any website or proxy owner can see the IP address of those who access it" and that it would add a warning to proxy links.

Desktop chat export XSS (fixed July 2026)

Researchers from ExPatch reported on 3 June 2026 that Telegram Desktop wrote bot button text into HTML chat exports without escaping it, so a crafted button could run JavaScript that reads an exported chat when opened in a browser. The bug dated to version 4.15.1 (March 2024) and was fixed in stable 7.0.1 on 14 July 2026. Updating does not clean exports made earlier.

Desktop one-click account takeover (fixed September 2026)

CVE-2026-107181 describes how a crafted tg:// link could make Telegram Desktop before 7.2.9 upload local files, including the session keys in its tdata folder, to an attacker's channel, allowing account takeover. It was fixed in version 7.2.9 on 17 September 2026 and published on 7 October 2026, rated 8.6 under CVSS 4.0. A local passcode blocks the takeover step.

Android voice calls and animated stickers (October 2026)

On 29 October 2026 the startup NebuSec disclosed a flaw in Telegram for Android versions 8.6.2 to 12.10.3 that it said could let an attacker run code on a phone once the victim answered a voice call. Telegram fixed it in 12.10.4 in late September; The Hacker News reported that Telegram did not think it could lead to remote code execution. NebuSec had not seen it used in attacks. Separately, the Zero Day Initiative published ZDI-26-757 (CVE-2026-111105) on 15 October 2026, a flaw in the rlottie library Telegram uses for animated stickers. Telegram told ZDI in March 2026 that server-side validation mitigated it; ZDI published it as unpatched.

What Telegram's Incidents Have in Common

• The phone number is the weak point. The 2016 enumeration, the 2019 Hong Kong matching and the 2020 fork dump were all about tying phone numbers to accounts. End-to-end encryption would not have changed any of them.
• SMS login codes. The 2016 takeovers worked because SMS can be intercepted. A 2-Step Verification password stops that; encryption alone does not.
• Unofficial clients. Open-source apps are a strength, but forks and third-party clients have leaked data and, per the 2021 MTProto paper, can implement the protocol unsafely.
• Client bugs in media and links. EvilVideo, the stickers advisory, the call flaw and the Desktop link bugs all attack the app on your device. End-to-end encryption does not help there, because the device holds the decrypted content.
• What the server holds. The data-sharing policy and the French case are about what Telegram can be compelled to provide. Telegram says it shares IP addresses and phone numbers, not messages. With end-to-end encryption by default, as in Telegram's Secret Chats, the server would not have readable message content to give. It would still have metadata such as phone numbers and IP addresses.

For how other apps compare, see which messaging apps are end-to-end encrypted.

How to Protect Your Telegram Account

1. Turn on 2-Step Verification (Settings, Privacy and Security) with a strong password and a recovery email. Telegram recommends this against SMS interception. See our two-factor authentication guide.
2. Hide your number: set "Phone Number" to Nobody and "Who Can Find Me By My Number" to My Contacts.
3. Limit calls: set Calls to My Contacts or Nobody, and set Peer-to-peer to Nobody or My Contacts so strangers don't see your IP address during calls.
4. Review Active Sessions regularly and terminate devices you don't recognise.
5. Set a local passcode on Telegram Desktop, which protects session files on the computer.
6. Keep apps updated and use only official Telegram apps from official stores or telegram.org.
7. Be careful with links and files: don't tap unknown proxy links or @usernames from strangers, never install an APK received in a chat, and treat old HTML chat exports as untrusted.
8. Use Secret Chats for anything sensitive, remembering they are one-on-one and tied to one device.

Telegram has no business admin console, so IT teams can't enforce these settings. If staff use Telegram for work, make the steps above part of onboarding, and have a plan for the first 24 hours after a data breach.

Frequently Asked Questions

Final Takeaway

Telegram's record is mostly about exposure around the messages rather than of them: phone numbers, IP addresses, locations and device identifiers, plus a steady stream of client bugs and, since 2024, more data handed to authorities. Turn on 2-Step Verification, hide your number and keep the app updated. If you need conversations the provider can't read, use end-to-end encryption by default.

That is how Lupyd works: direct messages use the Signal Protocol and group channels use MLS, and files and backups are encrypted on the device. Our server still sees group membership, roles and group names, group calls are not yet end-to-end encrypted, and Lupyd is a young product that has not had an external security audit. The Firefly engine is open source. Try Lupyd.

Sources & References

• Keep Calm and Send Telegrams!, Telegram Blog, 2 August 2016
• Iranian hackers compromise Telegram's secure messaging, Engadget, 2 August 2016, reporting Reuters
• Messaging app Telegram moves to protect identity of Hong Kong protesters, Joel Schectman, Reuters (via Global News), 31 August 2019
• Scheduled Messages, Reminders, Custom Cloud Themes and More Privacy, Telegram Blog, 5 September 2019
• Report on exposed Iranian Telegram user data, Comparitech and Bob Diachenko, March 2020
• Bug? No, Telegram exposing its users' precise location is a feature working as 'expected', The Register, 5 January 2021
• Watch Nearby! Privacy Analysis of the People Nearby Service of Telegram, Caprolu, Sciancalepore, Grigorov, Kolev and Oligeri, ACM WiSec 2024
• Telegram to remove 'people nearby' feature and improve moderation, says founder, The Irish Times, 6 September 2024
• Four Attacks and a Proof for Telegram, Albrecht, Mareková, Paterson and Stepanovs, IEEE S&P 2022 (disclosed July 2021)
• Cursed tapes: Exploiting the EvilVideo vulnerability on Telegram for Android, Lukas Stefanko, ESET Research, 22 July 2024
• French authorities charge Telegram's Durov in probe into organised crime on app, Reuters (via RNZ), 29 August 2024
• France lifts travel ban on Telegram founder Durov amid criminal activity probe, Khaleej Times, November 2025
• Telegram CEO Durov Says App to Provide More Data to Governments, Bloomberg, 23 September 2024
• Telegram Privacy Policy, Telegram
• Telegram reports spike in sharing user data with law enforcement, Zack Whittaker, TechCrunch, 7 January 2025
• Telegram Gave Authorities Data on More than 20,000 Users, Matthew Gault, 404 Media, 19 May 2025
• Telegram, the FSB, and the Man in the Middle, IStories and OCCRP, 10 June 2025
• Independent Review Confirms Critical Telegram Vulnerability Previously Exposed by IStories, Roman Anin, IStories, 18 May 2026
• Hidden Telegram proxy links can reveal your IP address in one click, Ax Sharma, BleepingComputer, 12 January 2026
• Telegram Desktop flaw could turn old chat exports into data theft traps, Security Affairs, September 2026
• CVE-2026-107181, National Vulnerability Database, published 7 October 2026
• Telegram Desktop v7.2.9 release, GitHub
• Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls, The Hacker News, October 2026
• ZDI-26-757: Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability, Zero Day Initiative, 15 October 2026

Last updated: 7 November 2026.