Telegram Bot Reportedly Spotted Selling Sensitive Personal Data of Indian Users

Telegram reportedly has a bot that sells sensitive personal data of Indian users to willing buyers. As per the report, the bot operates independently and shares information such as names, addresses, father's name, and even Aadhaar, Pan Card, and Voter ID numbers. The bot reportedly lets users find the full profile data of another Indian user based on their phone number. It also charges a fee for this service, which starts as low as Rs. 99.

Update: Telegram has reached out to Gadgets 360 to inform that the bot has been removed. The company also issued a statement: The distribution of private data (doxing) is explicitly forbidden by Telegram's terms of service and such content is removed whenever discovered. Moderators proactively monitor public parts of the platform and accept reports in order to remove millions of pieces of harmful content each day, including the distribution of private data.

Telegram Bot Charges Rs. 4,999 for Bulk Plans

The Telegram bot was discovered by Digit. The publication did not reveal the name of the bot to avoid its misuse or spread, but mentioned that its existence was revealed to them via a tip. Bots are a staple feature of Telegram, and can be created by anyone. These bots can be set up to send automated messages, connect to databases, and even handle financial transactions.

As per the report, this bot was designed to provide users with sensitive user data of users based on a mobile number. However, before providing its services, it is said to prompt the user to purchase a plan. These plans reportedly start as low as Rs. 99 and go as high as Rs. 4,999 (for bulk queries).

Once a plan has been purchased, it reportedly allows the buyers to send a 10-digit mobile number. The publication claimed that within two seconds of sharing the number, the bot provides a full profile of the person associated with the number. The data includes their name, alternate phone number, address, and even voter ID. The bot can reportedly also show Aadhaar and Pan Card numbers, as well.

The publication also used mobile numbers of its staff members to verify the authenticity of the details shared by the bot, and confirmed that not only was the data accurate, but it was also recent. In a few instances, the data was reportedly three to four years old.

While it cannot be said with certainty, the report claims that the hackers behind the bot could have come across this data via multiple data breaches in the past. Regardless, such Telegram bots operating openly within a publicly available app are concerning as bad actors can use them for identity theft, online scams, and even stalking and harassment.