Thursday, May 1, 2025
Homecyber security361 Million Unique Email Credentials Leaked On Telegram Channels

361 Million Unique Email Credentials Leaked On Telegram Channels

Published on

SIEM as a Service

Follow Us on Google News

Over 122GB of data was scraped from thousands of Telegram channels, containing 1.7k files with 2B lines and 361M unique email addresses, of which 151M had never been seen in Have I Been Pwned (HIBP) before.

Alongside those addresses were passwords and, in many cases, the website the data pertains to.

I loaded it into HIBP today because there are many previously unseen email addresses, and based on all the checks I’ve done, it’s legitimate data, TroyHunt said.

- Advertisement - Google News

That’s the high-level overview. Here are the details.

Telegram: A Breeding Ground for Data Breaches

Telegram is a popular messaging platform that makes it easy to set up a “channel” and share information with those who wish to visit it.

As Telegram describes the service, it’s simple, private, and secure.

As such, it has become very popular with those wishing to share content anonymously, including content related to data breaches.

Many of the breaches I’ve previously loaded into HIBP have been distributed via Telegram as it’s simple to publish this class of data to the platform.

According to Troy Hunt’s blog, the data posted to Telegram often appears as “combolists,” which are combinations of email addresses or usernames and passwords.

These combinations are used to authenticate to various services, and attackers often use these lists to mount “credential stuffing” attacks, where they attempt to access accounts en masse.

The list above is simply breaking the combos into their respective email service providers.

The Scale of the Breach

The data sent to me last week was sourced from 518 different channels and amounted to 1,748 separate files similar to the one above.

With ANYRUN You can Analyze any URL, Files & Email for Malicious Activity : Start your Analysis

Some of the files have no data (0kb), while others are many gigabytes with many tens of millions of rows. For example, the largest file starts like this:

largest file starts
largest file starts

This looks very much like the result of info stealer malware that has obtained credentials as they were entered into websites on compromised machines.

For example, the first record appears to have been snared when someone attempted to log in to Nike.

first record appears to have been snared when someone attempted to log in to Nike.
first record appears to have been snared when someone attempted to log in to Nike.

Verifying the Data

To get a sense of the accuracy of this data, HIBP tested several email addresses on various websites.

email addresses on various websites.
email addresses on various websites.

For instance, entering an email address from the stealer log on the Nike homepage confirmed that the address had an account.

Similarly, other services like Footlocker and an Italian tire retailer confirmed the existence of the tested accounts.

 existence of the tested accounts.
existence of the tested accounts.

Subscriber Feedback

Existing HIBP subscribers are contacted to verify the legitimacy of the data.

They are able to confirm the accuracy of the details but noted they were leaked in previous data breaches.

Another subscriber, in 7 prior breaches, found the credentials familiar, likely reused from previous breaches.

One fascinating case involved a subscriber’s daughter with an Epic Games account.

The credentials matched her old account, confirming the legitimacy of the data.

To understand the impact of the unseen addresses, I contacted HIBP subscribers who had never appeared in a breach before.

This ruled out repurposed prior incidents and provided a clearer picture of the data’s significance.

The responses confirmed the legitimacy and uniqueness of the data, highlighting the breach’s extensive reach.

The leak of 361 million unique email credentials on Telegram channels is a significant data breach, with 151 million previously unseen addresses now loaded into HIBP.

This incident underscores the importance of robust cybersecurity measures and the need for users to remain vigilant about their online credentials.

Looking for Full Data Breach Protection? Try Cynet's All-in-One Cybersecurity Platform for MSPs: Try Free Demo 

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Tor Browser 14.5.1 Released with Enhanced Security and New Features

The Tor Project has announced the official release of Tor Browser 14.5.1, introducing a...

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Tor Browser 14.5.1 Released with Enhanced Security and New Features

The Tor Project has announced the official release of Tor Browser 14.5.1, introducing a...

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...