Massive Telegram user data leak (182M records)

Detected19 September 2026 · 22:37 UTC

Why it matters

A large Telegram user dataset (182M + 13.41M + 0.7M records) is being redistributed on RaidForums, reportedly with phone numbers and account identifiers. This kind of data fuels phishing, SIM-swap and account-takeover campaigns. It appears to be a known/older repost rather than a fresh breach, so it is context, not an alert.

MetadataRECORD

CategoryLeak

Severitylow

Priority score35

Detected19 September 2026 · 22:37 UTC

Related items6

Leak● 42

Base de datos bancaria sin identificar publicada en BreachForumsBreachForums user 'Roos' published a fresh thread on 4 November 2026 titled simply 'DATABASE OF BANK' in the Databases section, without naming the institution in the visible portion. Bank datasets circulating on leak forums typically contain customer identity, account and card data that fuels fraud and account takeover. The target is unconfirmed, so this is a monitor-and-correlate item rather than an actionable victim alert.

29m

Leak● 54

Filtración de 100.000 clientes de un banco de Estados UnidosA thread on spear.cx advertises a 'Database USA Bank 100k USER FULL INFO LEAKED FILE FRESH', claiming full personal information for roughly 100,000 banking customers. The full record set would support account takeover, loan and card fraud, and targeted phishing against the bank's clients. The bank is unnamed and the post sits behind a login wall, so verification of the institution and freshness is needed before attribution.

29m

Leak● 74

Venta de base de datos de 335 millones de usuarios de BinanceA seller on Cracked.st claims to be selling a dataset of '335 Million Verified' Binance crypto user records, posted alongside other threads dated 01.11. If genuine, this is one of the largest crypto-exchange leaks ever offered, exposing identity and contact data usable for phishing, SIM-swap and account takeover. Even if inflated, defenders at exchanges and crypto custodians should treat it as a live credential-stuffing and social-engineering risk.

29m

Leak● 48

Nuevo volcado de base de datos de Ledger de octubre de 2026A forum thread on the PwnFrm onion site advertises a new 'Ledger' database file dated October 2026, with content hidden behind a login wall. Ledger is a hardware-wallet vendor whose customer data has been targeted before, and fresh contact data fuels phishing and physical-threat scams against crypto holders. The claim is unverified and the sample cannot be assessed, so treat it as a lead to validate rather than a confirmed breach.

Leak● 60

A la venta datos del breach de Pegasus Airlines (flypgs.com)An actor is advertising data allegedly exfiltrated from Pegasus Airlines (flypgs.com), a major Turkish low-cost carrier. The record count and fields are unconfirmed and the thread is login-gated, but airline customer, booking and identity data are high-value for phishing, fraud and account takeover.

Leak● 68

Filtración de la base de datos de Healthcasts con 1,5 millones de registrosA full database allegedly belonging to healthcasts.com, a US platform for healthcare professionals, is being shared on BreachForums with 1,511,293 records. The post claims the complete dataset, which would include professional accounts, emails and profile data attractive for phishing of medical staff. Healthcare-sector credential leaks are high value for subsequent targeting of hospital and clinic networks.