Iranian Telegram User Data Exposed: Insights Into A Major Security Breach

By Editor Last updated Mrz 4, 2025

The recent security breach of the Iranian messaging app, Telegram, has raised concerns over the privacy and security of user data. This breach involved the exposure of over 42 million user records, including phone numbers, user account IDs, hashes, secret keys, and usernames. The breach occurred between March 15 and March 24, during which unauthorized parties had access to the data. It is important to note that the hashes and secret keys cannot be used to access accounts and are limited to their associated accounts. This incident is not the first data breach in Iran, as a similar occurrence took place last year, involving a regional ride-hailing app. The data was uploaded by an Iranian hacker group called Hunting system, who obtained it from unauthorized versions of Telegram. In response, Telegram has emphasized the use of reliable and verifiable builds to ensure user safety. This article aims to provide insights into the major security breach and its implications for Iranian Telegram users.

Quickjump

Key Takeaways

The personal data of over 42 million Iranian Telegram users was leaked online, including phone numbers, user account IDs, hashes and secret keys, and usernames.
The breach occurred due to a misconfigured Elasticsearch cluster, which allowed unauthorized parties to access the data.
Hashes and secret keys obtained from the breach cannot be used to access user accounts, as they only function within the associated accounts.
This is not the first major data breach in Iran, as a regional ride-hailing app previously leaked data of 1-2 million truckers.

Exposure Timeline

The exposure timeline of the Iranian Telegram user data breach reveals that the database was recorded by BinaryEdge on March 15, the data was discovered and investigation started on March 21, a violation report was given to the hosting provider on March 24, and the Elasticsearch cluster was removed on March 25, during which time unauthorized parties had access to the data. This breach had a significant impact on Iranian Telegram users as more than 42 million records, including phone numbers, user account IDs, hashes and secret keys, and usernames, were exposed. To prevent future breaches, Iranian authorities have taken steps such as ordering temporary and then permanent blocks on Telegram in 2015, 2017, and early 2018. However, users still access the app through proxies and VPNs. It is crucial for Iranian authorities to continue improving their cybersecurity measures to safeguard user data.

Data Exposed

More than 42 million records were compromised in the Iranian Telegram data breach. The exposed data includes phone numbers, user account IDs, hashes, secret keys, and usernames. This significant breach has had a profound impact on Iranian citizens, as their personal information has been exposed to unauthorized parties. To prevent future data breaches, it is crucial to take immediate action. This includes enhancing security measures, such as implementing robust encryption protocols, regularly updating software, and conducting thorough security audits. Additionally, educating users about best practices for protecting their personal information and promoting the use of reliable and verifiable builds can help mitigate the risk of data breaches. It is imperative to prioritize the privacy and security of user data to ensure the freedom and safety of individuals.

Telegram’s Response

Telegram has responded to the recent breach by stating that the unauthorized fork of their app was the source of the leaked data and encourages users to utilize reliable and verifiable builds. This response from Telegram suggests that the data breach was not a result of any vulnerabilities within their official app. By blaming the unauthorized fork, Telegram aims to distance itself from the incident and emphasize the importance of using trustworthy versions of their app. However, this response raises concerns about the security of using unauthorized versions of Telegram in Iran. Iranian users, who heavily rely on the app due to its popularity and the blocking of the official version, may now question the safety of their personal information. Telegram’s response underscores the need for users to exercise caution and prioritize the use of verified and secure builds to protect their data.

Frequently Asked Questions

How did the hacker group access the Iranian Telegram user data?

The hacker group accessed the Iranian Telegram user data through security vulnerabilities and methods that have not been specified. The exact techniques used to breach the system have not been disclosed in the provided information.

What actions were taken by the hosting provider after receiving the violation report?

After receiving the violation report, the hosting provider likely investigated the issue and took steps to remove the Elasticsearch cluster. The potential legal implications for the hosting provider could include legal action, fines, or damage to their reputation. Additionally, this security breach could significantly impact the trust of Iranian Telegram users and their perception of online privacy, as their personal information was exposed.

Are there any measures in place to prevent unauthorized access to accounts using the exposed hashes and secret keys?

Preventing unauthorized access to accounts using exposed hashes and secret keys can be achieved by implementing strong security measures. This includes robust encryption algorithms, secure password storage mechanisms, multi-factor authentication, and regular security audits to identify vulnerabilities and address them promptly. These measures help strengthen the overall security of user accounts and mitigate the risks associated with data breaches.

How did the previous data breaches in Iran, such as the one involving the ride-hailing app, occur?

Data breaches in Iran, such as the ride-hailing app incident, can occur due to misconfigured databases. The role of the government in protecting user data is crucial to maintain trust in Iranian apps and prevent unauthorized access.

Besides Telegram, are there any other messaging apps that are popular in Iran despite being blocked?

Alternative messaging apps in Iran, such as WhatsApp, Signal, and Viber, are popular despite being blocked. The blocking of messaging apps by Iranian authorities has had a significant impact on Iranian society, limiting freedom of communication and forcing users to resort to proxies and VPNs.