Summary:
Telegram disclosed that it fulfilled 900 requests from U.S. law enforcement in 2024, resulting in the sharing of phone numbers or IP addresses of 2,253 users. This represents a sharp increase from prior years, largely attributed to a significant policy shift in September 2024. Previously, Telegram restricted data-sharing to terrorism-related cases and had processed only 14 requests affecting 108 users.


Under the updated policy, Telegram now shares user data in cases involving cybercrime, illegal goods sales, and online fraud. According to Telegram's revised privacy policy, if the platform receives a valid judicial order confirming a user as a suspect in criminal activities violating Telegram's Terms of Service, it may disclose IP addresses and phone numbers after legal analysis. This change followed mounting legal pressure and the August arrest of CEO Pavel Durov in France. Durov faced charges including complicity in cybercrime, organized fraud, distributing illegal material, and refusing lawful interception requests to assist crime investigations.

Security Officer Comments:
Telegram, long known as a hub for private communications and bypassing censorship, has also been a popular platform for cybercriminals. Threat actors use it to sell illegal services, stolen data, and as a command-and-control channel for malware operations. While some cybercriminal groups announced their departure from Telegram following the policy update, cybercrime intelligence firm KELA reported that the platform’s use for illicit purposes remains largely unchanged as of December 2024. The surge in data-sharing highlights a shift in Telegram's operational strategy, reflecting greater cooperation with authorities. However, the full impact of this change on both criminal activity and user trust will likely become clearer in April 2025, with the release of the next transparency report.


Link(s):
https://www.bleepingcomputer.com/ne...-on-thousands-of-users-to-us-law-enforcement/