Telegram User Data Breach Reportedly Exposes 16,067 Phone Numbers

HEROIC analysts reportedly identified an exposure tied to Telegram, a messaging app, dated January 1, 2026, affecting 16,067 records. The data reportedly included usernames, phone numbers, and first names. The only way to know for certain whether your own information is part of this exposure is to scan your email.

What Someone Could Do With This Combination

A username and first name aren't especially sensitive on their own, but paired with a real phone number, they give a scammer exactly what's needed to send a convincing text message. Attackers can pose as the app itself, as a contact, or as a delivery or verification service, using your real name to make the message feel personal.

The Specific Data Involved

• Username
• Phone Number
• First Name

The Real-World Impact

Phone numbers tied to a real name and username make text-based phishing far more convincing, especially when the message appears to reference an account you actually use. That same information can also be used to attempt social engineering against other services that rely on phone-based verification.

How Data Like This Typically Gets Out

HEROIC analysts classify incidents like this one as database exposures, meaning the records were reportedly taken from the company's own systems rather than collected one device at a time through malware. In practice, this usually means account information was accessed without authorization and later began circulating. Because this report is unverified, HEROIC analysts treat it as credible but not yet confirmed.

Was Your Phone Number Part of This Telegram Exposure?

The fastest way to find out is to scan your email. If your information turns up, be cautious of unexpected texts or calls that use your real name and claim to be from the app, a contact, or a verification service asking you to click a link or share a code. It's worth checking both your personal and work email addresses, since either one could be tied to an account in a dataset like this.