Shortly after the Russian government lifted its futile two-year ban on Telegram, the privacy-focused messaging app was found to suffered a data leak that exposed some personal data of its users.
What happened here was its database that contained the personal information, had been posted on a darknet forum.
First reported by KOD.RU, a Russian-language tech publication, the database is said to contain phone numbers and unique Telegram user IDs.
When it was found, the leaked database has about 900 megabytes worth of users' information, 70% of which came from users in Iran, while the remaining 30% were from users in Russia.
Telegram has acknowledged the existence of the leaked database, saying that the database was leaked through its built-in contacts import feature at registration.
In its defense, Telegram said that the data in the leaked database is mostly outdated.
According to the report, 84% of data entries in the database were collected before mid-2019. What this means, at least 60% of the data sold on dark web forums is outdated.
The company also said that it's platform is not the only one vulnerable to this kind of attack, saying that all contact-based apps are also vulnerable. This includes the company’s biggest rival, WhatsApp.
According to its spokesperson:
The spokesperson also emphasized that the leaked database only contains the connections between phone numbers and Telegram user IDs, and that no accounts have been accessed.
This is because the leaked database does not contain user passwords, messages or sensitive data.
As quoted by KOD.RU. the spokespoerson said that:
"In addition, after messages from Hong Kong, we added the setting 'Who can add me to contacts by phone number.' This setting, although it makes it difficult for ordinary users to use Telegram (they become 'invisible' even for those who know their number), allows dissidents and protest activists to completely hide the connection between their account and phone number."
