Paragraf

We noticed an unusual aggregation of user credentials and personal identifiers surfacing across several dark web monitoring channels in late October 2024. The initial alert flagged a significant volume of data attributed to a platform known as "Paragraf," a service we had previously cataloged as having ceased operations. What struck us was the relatively clean, structured nature of the leaked dataset, suggesting a deliberate exfiltration rather than a random, opportunistic dump. The presence of direct contact information, specifically phone numbers alongside email addresses, is a notable characteristic that warrants immediate attention for potential downstream exploitation.

The breach, discovered on 27-Oct-2024, appears to stem from a database compromise affecting the now-defunct online community publishing platform, Paragraf. Analysis indicates that approximately 17,550 unique records were exposed, comprising a combination of Email Addresses, Phone Numbers, First Names, and Last Names. While the total number of records compromised is cited at over 347,000, the distinct user count is significantly lower, suggesting potential duplication or incomplete entries within the larger dataset. The threat theme here is clearly PII harvesting for targeted social engineering or identity theft campaigns. The exfiltrated data was subsequently disseminated via a public Telegram channel, a common vector for initial data distribution before potential resale or wider public access.

While Paragraf itself has ceased operations, the implications of this leak extend beyond its former user base. The exposure of this PII could be leveraged by threat actors to target individuals who may have used Paragraf as a secondary platform or who share similar contact details across other, active services. We are not aware of any immediate public news coverage specifically detailing this particular Paragraf breach. However, the general trend of data breaches from defunct platforms being resurfaced for exploitation remains a persistent concern within the OSINT landscape. Further investigation into the Telegram channel's activity might reveal the original source of the compromise and any associated threat actor groups.