In January 2024, a Telegram channel posted what researchers named MOAB — the Mother of All Breaches. It held 26 billion records aggregated from LinkedIn, Twitter, Tencent, Weibo, and hundreds of other sources. The channel had 40,000 subscribers within 72 hours. The data was free. No Tor browser. No cryptocurrency required. Just a Telegram account.
That event was not an anomaly. It was the public-facing surface of a market that has operated on Telegram for years. By most threat intelligence estimates, it has grown every year since 2020. The shift from dark web forums to Telegram reflects a fundamental change in how stolen data circulates: from technically inaccessible to reachable by anyone with a smartphone.
The short answer: Telegram has become a primary marketplace for stolen personal data because it removes the friction of the dark web. No Tor browser, no crypto wallet, and channels are searchable. Markets sell free combolists, “fullz” identity packages, fresh stealer logs, OTP bots, and lookup bots. Fresh data costs the most, since sessions and passwords are more likely to still work. To protect yourself, monitor your identifiers, act fast on any alert, use unique passwords, and enable app-based two-factor authentication.
In this article:
- Why Telegram replaced dark web forums
- The taxonomy of breach groups
- The Indian market
- How data gets into these channels
- The economics in detail
- Who buys this data
- The freshness window
- Law enforcement response
- What monitoring means in practice
- What to do when you get an alert
- Frequently asked questions
Why did Telegram replace dark web forums?
Traditional dark web marketplaces required Tor, cryptocurrency wallets, forum accounts, and a working knowledge of how to navigate .onion addresses. That friction excluded most of the people who might buy or sell breach data, and it gave law enforcement a consistent profile to target. Telegram removed nearly all of it.
Telegram accounts require only a phone number, which can be a temporary number from any SIM. Messages in channels and groups can be set to self-destruct. The platform does not scan file contents. Bots — automated accounts that respond to commands — run natively within Telegram, so sellers can automate queries without writing custom infrastructure. File sharing supports files up to 1GB compressed, large enough to distribute breach dumps of several million records in a single post.
Critically, Telegram’s public channel search makes groups discoverable. A user searching for terms like “fullz USA” or “stealer logs fresh” finds active selling channels without needing an invitation or referral. This discoverability drives the scale. Forums on dark web marketplaces relied on reputation-gated access to maintain some operational security. Telegram markets are deliberately visible — the more subscribers a channel accumulates, the more potential buyers see each listing.
Telegram’s response to law enforcement requests has historically been limited. The company’s stated policy requires a court order from a jurisdiction Telegram recognises, and its moderation of illegal content has been inconsistent. Channels taken down frequently reappear under new names within days, with the same operators announcing the migration in affiliated channels. The arrest of Telegram’s CEO Pavel Durov in France in August 2024 prompted some changes to the company’s cooperation policies. But threat intelligence firms including Flare Systems and Cybersixgill have documented continued active markets throughout 2025.
The Taxonomy of Breach Groups
Not all Telegram breach channels operate the same way. Threat intelligence researchers have identified four primary market types, each serving different buyers and pricing differently.
Free combolists channels distribute bulk credential dumps — millions of email:password or username:password pairs in text files — at no cost. The purpose is channel growth. A high-subscriber channel with a history of real data is more credible to future buyers of paid content. Combolist data is typically old: aggregated from multiple prior breaches, deduplicated, and sorted by domain. A combolist of Gmail accounts from 2023 aggregations might contain 15 million lines. The data’s value to the channel operator is advertising. Its value to a buyer is credential stuffing: running the combinations against banking, e-commerce, and streaming accounts to find where the user reused their password.
Paid “fullz” sellers offer complete identity packages. A package holds a full name, date of birth, Social Security Number, current address, bank account and routing numbers, and sometimes a scan of a driver’s licence or passport. These are used for new-account fraud, tax refund theft, and credit application fraud. US fullz priced at $10–30 per identity in documented market sampling by Flashpoint and Cybersixgill through 2024. Premium fullz — verified to have no existing fraud flags, with a clean credit file — command higher prices. The sellers often offer replacement guarantees: if the identity bounces during fraud, they replace it.
Stealer log markets sell the fresh output of infostealer malware. Redline, Raccoon, and Vidar are the three most prevalent families. Each runs silently on an infected device and exfiltrates browser-stored passwords, active session cookies, autofill form data, crypto wallet seed phrases, saved credit card numbers, and desktop files. A single log from one infected device can contain hundreds of saved passwords, session cookies for banking and e-commerce sites, and enough autofill data to populate a credit application. Logs are priced by the value of the sessions they contain: a log with an active online banking session and a crypto wallet seed phrase sells for $80–200. A log with only retail account sessions and no financial access sells for $5–20. Markets like Russian Market and 2Easy, which operate as Telegram-adjacent storefronts, have been documented selling millions of logs over their operational history.
OTP bot services are automated systems that call a target’s phone number in real time, impersonating their bank, and social-engineer them into reading out the one-time password they just received. The attacker purchases OTP-bot access, sets up an automated call to the victim using a spoofed bank phone number, and simultaneously initiates a login on the bank’s site. When the site sends an SMS code, the OTP bot’s automated voice asks the victim to verify their identity by reading the code aloud. It sounds like a bank fraud team. The bot captures the code, and the attacker then enters it. The entire process takes under 60 seconds. OTP bot services are sold on monthly subscription or per-use pricing.
Lookup bots accept a phone number, email address, or full name and return associated data from aggregated breach and data broker records. A phone number query might return the registered name, carrier, current address, and which breaches contain that number. These bots are used by scammers to pre-screen targets and personalise social engineering calls. They’re priced per query, with bulk discounts.
The Indian Market
India’s exposure in these channels is disproportionate to the amount of coverage the English-language security press gives it. CERT-In’s 2023 annual report placed India in the top five most-breached countries globally. Indian threat intelligence firms Cyble and CloudSEK have both published documented market research on Telegram groups trading specifically in Indian citizen data.
The data types that appear most frequently in Indian-focused channels are different from the US market. PAN card numbers combined with full names and dates of birth are common — this combination is sufficient to apply for financial products. Aadhaar-linked phone records — mobile numbers verified to a specific Aadhaar number — are valuable for SIM swap attacks. Health insurance subscriber records appear in channels following breaches of insurance administrators. KYC document bundles — the identity documentation Indian financial services companies require — are sold as packages.
HDFC Bank, ICICI Bank, and SBI customer data has been advertised in these channels in formats that include account numbers, registered mobile numbers, and email addresses. Threat intelligence companies differ on how much of this data reflects genuine breaches. The rest may be aggregation of leaked call centre data, or earlier breaches restated with new packaging to command fresh prices.
The 2021 MobiKwik breach is the most extensively documented Indian case in this category. An attacker published 8.2TB of KYC data from 3.5 million MobiKwik users on a dark web forum, then promoted the dump via Telegram channels. The data included names, dates of birth, addresses, PAN cards, Aadhaar numbers, and bank account details. MobiKwik disputed that the breach had occurred; the data’s presence and content were independently verified by multiple researchers. The breach was never formally acknowledged by the company under India’s then-applicable IT Act 2000 frameworks, which had no mandatory breach notification requirement. The Digital Personal Data Protection Act 2023 introduced notification requirements. Its rules were notified in November 2025, but as of mid-2026 the Data Protection Board is not yet fully operational and enforcement is still phasing in.
Indian aadhaar-linked identity packages were documented trading at ₹500–2,000 per record in CloudSEK’s 2023 Telegram market research. At scale, a set of 10,000 verified records with full KYC data costs less than organising a physical mail campaign.
How does data get into these channels?
Breach data enters Telegram markets through several distinct pipelines, each with different freshness and accuracy characteristics.
Initial access brokers are the entry point for corporate breaches. These are attackers who gain a foothold inside a company network, often by purchasing or phishing valid employee credentials. They then sell that access rather than exploiting it themselves. Buyers may be ransomware operators, espionage groups, or data thieves. When a company is breached and customer data exfiltrated, that data frequently appears in Telegram markets within weeks.
Infostealer malware is the most reliable source of fresh data. Redline, Raccoon, and Vidar stealers are distributed through pirated software downloads, malicious Chrome extensions, fake software update prompts, and YouTube video descriptions linking to supposed cracked applications. Once executed on a device, the stealer runs, exfiltrates its target data to a command-and-control server, and exits — often in under 30 seconds. The operator of the stealer then sells the logs through Telegram. Because this pipeline runs continuously, stealer log markets always have fresh inventory.
Public breach data is republished and enriched. An operator takes a 2022 breach of a retail company and combines it with a 2023 breach of an insurance company. They match records by email address, producing an enriched dataset with more fields than either original breach. This enrichment creates packages that appear more valuable than the individual components, and commands higher prices.
Insider access is a smaller but documented channel. Employees with access to customer databases have sold queries or bulk exports through Telegram. The Indian call centre industry has been specifically identified by CloudSEK research as a source of CRM data sold in Telegram markets.
The Economics in Detail
The pricing structure of Telegram breach markets reflects a specific business model: use free data to grow channels, then monetise premium inventory.
Free combolist dumps drive subscriptions. A channel with 200,000 subscribers and a history of posting verified breach data is worth more than one without that history, because it has a larger audience for paid listings. This is why free data continues to circulate even though its components could be sold — the subscriber count is the asset.
Premium subscriptions exist for channels offering “fresh” data — typically defined as under 30 days old. The freshness premium reflects practical value. A session cookie less than two weeks old may still be valid. An email:password combination used last month is more likely to be unchanged than one from three years ago. Aged data trades at discount — 80% below fresh pricing for the same category of record.
Custom queries bill per record: a lookup bot that returns current home address from a phone number charges per successful match. Bulk queries receive volume discounts, making it economically viable to query thousands of records for a targeted fraud campaign.
A fresh US bank session cookie is a browser authentication token that lets an attacker log into the bank account without entering credentials. It sells for $20–80 depending on the bank and the visible account balance. When a stealer log contains a bank session cookie alongside the credentials for that account, the package price increases. The buyer now has two different attack paths to the money.
Who Buys This Data
The buyers are not a monolith. Different data types attract different operator categories, and understanding who uses which data explains why certain information is consistently more valuable than other types.
Credential stuffing operators run automated software — Sentry MBA, OpenBullet, SilverBullet — that takes a combolist and systematically tests each credential against a target site. The target is any site where a successful login yields value: bank accounts, cryptocurrency exchanges, loyalty programmes, streaming services. The success rate per credential is low, typically 0.1–2%, but at millions of credentials per run and thousands of runs per day, the volume compensates. These operators buy combolist data at scale and cheap.
Romance scammers use data to build targeted lists. Say a scammer builds a list of 50-plus single individuals with above-average income in a specific city, matching data broker records with social media profiles and breach data. That list lets them prioritise high-yield targets instead of cold-contacting random numbers. Location and income data from data brokers and breach records drives this targeting.
SIM swap contractors are sometimes hired by criminal groups who lack the social engineering skills to execute the carrier call themselves. The contractor purchases target information — full name, carrier, account PIN from breached carrier data — and executes the swap for a flat fee. OTP bot subscriptions serve the same market for cases where a SIM swap is too risky or time-consuming.
Tax fraud syndicates use fullz — complete identity packages — to file fraudulent tax returns and claim refunds before the legitimate taxpayer files. The IRS received over 294,000 reports of identity theft tax fraud in tax year 2023. The window to exploit this is narrow: after the legitimate return is filed, the fraud fails. So fullz buyers in this category move quickly on fresh inventory.
Business email compromise operators need accounts-payable contact information: the name, email address, and role of the person authorised to transfer funds at a target company. Breach data combined with LinkedIn data provides this. A successful BEC attack that redirects a single wire transfer yields orders of magnitude more than credential stuffing returns.
The Freshness Window
Freshness is the dominant pricing variable in stealer log and session cookie markets. It reflects a genuine operational constraint: action needs to happen before the victim or their bank detects the compromise.
A bank session cookie issued when a user logs in without selecting “remember me” might expire in 30 minutes. A cookie from a “stay logged in” session might be valid for 30 days. When that cookie appears in a stealer log, the attacker has a window between when the cookie was stolen and when it expires or is revoked to use it. Fresh logs — from malware infections in the last two weeks — command the highest prices because the probability that sessions remain valid is highest.
The same logic applies to credentials: a password changed six months ago is less likely to be current than one from a device infected three weeks ago. Markets reflect this accurately in pricing. A log less than 7 days old commands 3–5 times the price of an identical log 45 days old.
This window is what makes alert speed matter. Say a monitoring system detects your email in a stealer log today and alerts you the same day. You can change the relevant password and revoke active sessions before an attacker has completed the purchase and acted on the data. If the alert arrives three weeks after the log was posted, you are likely already inside the attacker’s action window.
Law Enforcement Response
Operation Cookie Monster took down Genesis Market in April 2023. It was coordinated by the DOJ, Europol, and law enforcement agencies from 17 countries. Genesis was a dark web and clearnet marketplace that sold stealer logs and browser fingerprints. The operation resulted in 119 arrests globally and seizure of the Genesis Market infrastructure. At its peak, Genesis Market offered access to over 1.5 million compromised devices.
The FBI, Europol, and India’s Indian Cybercrime Coordination Centre (I4C) have all issued public guidance on stealer log threats and Telegram-based data markets. Law enforcement pressure produces visible results against specific infrastructure: site takedowns, arrests, and occasionally the disruption of specific malware distribution networks.
The structural problem is speed of regeneration. Within days of the Cookie Monster operation, Telegram channels carrying Genesis Market data had migrated to alternative storefronts. New markets appear regularly. The operators behind identified markets frequently surface operating new channels or moved to alternative platforms. Threat intelligence firms that track these markets report a consistent pattern. Takedowns reduce supply temporarily, and sometimes permanently for specific high-profile operators. But they do not reduce the total volume of data in circulation. The economics of running a Telegram channel are too low-cost, and the operator risk too manageable with basic operational security, for enforcement alone to be the solution.
What Monitoring Means in Practice
Threat intelligence platforms such as Cybersixgill, Flare Systems, and Constella Intelligence continuously ingest Telegram channels, dark web forums, paste sites, and stealer log markets. They index the content and alert subscribing users when monitored identifiers appear: email addresses, phone numbers, full names, or combinations. KnytX Vigil is built to do the same for individuals once it launches.
The difference between these platforms and a service like HaveIBeenPwned is continuous coverage and breadth. HaveIBeenPwned covers disclosed public breaches and some stealer log data; enterprise-grade platforms also ingest private Telegram channels, fresh stealer logs not yet publicly indexed, and lookup bot databases.
An alert from one of these systems tells you which data appeared, in which channel, and when. So you know whether it is a five-year-old breach republished or fresh stealer log data from this month. That distinction changes the urgency and scope of the response. An old breach republication of just an email address requires a password check. A fresh stealer log means there may be an active malware infection on one of your devices that has not yet been identified.
What to Do When You Get an Alert
Change the credential implicated in the alert immediately. Do not rotate all passwords speculatively — start with what appeared in the alert and then work outward to any site where you reused the same password.
Check active sessions on financial accounts. Most retail banks now show a “devices and sessions” or “connected devices” page in security settings. If you see sessions you do not recognise or devices you have not used, terminate them. This is particularly important if the alert includes a session cookie rather than just a credential.
Place a fraud alert with the major credit bureaus. In the US: Equifax, Experian, and TransUnion each accept fraud alerts free; a fraud alert requires creditors to take extra steps to verify identity before opening new accounts. An extended fraud alert lasts seven years. In India, the credit bureaus are CIBIL, Equifax, Experian, and CRIF High Mark; CIBIL fraud alerts are initiated through the bureau’s dispute process. These do not prevent someone from using existing credentials to log into accounts, but they prevent new credit being opened in your name.
Monitor for account recovery attempts. A flood of password reset emails or SMS codes you did not request means someone is attempting to access accounts using your identifiers. Secure the most sensitive accounts first — email, bank, and any account from which a password reset can cascade to other services.
Review the devices you use. If the alert flagged stealer log data specifically (session cookies, autofill data, saved passwords), run a malware scan on any Windows devices you use. Stealer malware does not always trigger antivirus. Look for recently installed browser extensions you do not remember installing, and check browser settings for unexpected proxy or DNS configuration changes.
Frequently asked questions
Why is stolen data sold on Telegram instead of the dark web? Telegram removes the friction. There’s no Tor browser or crypto wallet needed to join, channels are searchable, and bots automate sales. That lowers the barrier for both buyers and sellers.
What kinds of data are sold in these Telegram markets? Several types. Free combolists (bulk email:password pairs), “fullz” identity packages, fresh stealer logs (passwords and session cookies), OTP bots, and lookup bots that return a person’s details from a phone number or email.
Why does “fresh” data cost more? Because it’s more likely to still work. A recent session cookie may still be valid, and a recently stolen password is less likely to have been changed. Fresh logs can cost several times more than data 45 days old.
How do I know if my data is being sold? Search Have I Been Pwned for public breaches, and watch for scam calls that quote your real details. Dedicated monitoring services also index private Telegram channels and fresh stealer logs. Check where your details resurface on people-search sites too.
What should I do if I get a breach alert? Change the affected password everywhere you reused it and terminate unfamiliar account sessions. Then place a fraud alert with the credit bureaus, and scan your devices for stealer malware if session data was involved.