Telegram bot sells Indian citizens' Aadhaar, PAN and other details for as low as Rs 99; sparks privacy concerns

Update: Telegram has informed Business Today that it has removed the bot.

Here's the official statement from Telegram: The distribution of private data (doxing) is explicitly forbidden by Telegram's terms of service and such content is removed whenever discovered. Moderators proactively monitor public parts of the platform and accept reports in order to remove millions of pieces of harmful content each day, including the distribution of private data.
 
More info is available here, including daily stats: telegram.org/moderation

 

A new investigation has revealed the existence of a Telegram bot that is reportedly selling sensitive personal data of Indian citizens, including Aadhaar numbers, PAN card details, voter IDs, and residential addresses, for as little as ₹99. The bot, which operates openly on Telegram, offers users the ability to retrieve full personal profiles based solely on a mobile number.

First reported by Digit, the bot allows buyers to enter a 10-digit number and, within seconds, provides a detailed dossier containing the individual’s full name, father’s name, alternate phone numbers, current and previous addresses, and identity documents. The service follows a pricing structure, starting at ₹99 per request, and extending to ₹4,999 for bulk or unlimited monthly access.

To verify the bot’s claims, the publication tested it using mobile numbers belonging to its own editorial team. The results were not only accurate but also up to date, and in some cases, the data was merely three to four years old. The origin of the leaked data remains uncertain, but it is suspected to be the result of previous data breaches involving telecom operators, fintech platforms, and public utilities.

Bots are a standard feature on Telegram and can be developed by anyone, often for benign tasks such as automating replies or integrating payment systems. However, this particular bot highlights a darker trend, one where encrypted messaging platforms are being used to distribute personal data with little oversight.

While the bot’s identity has not been revealed to avoid misuse, the sheer ease with which it can be accessed points to a larger issue. Experts warn that such tools can be used for identity theft, SIM swapping, fraudulent KYC verifications, harassment, and loan scams. With personal details so easily available, malicious actors can manipulate this data to impersonate victims or gain unauthorised access to financial services.

In light of these findings, it’s hard not to recall the massive data breach reported earlier this year, in which over 16 billion passwords and login credentials were found circulating online, serving as a grim reminder that privacy, in today’s digital age, is increasingly becoming a myth.

The continued availability of such bots, coupled with the lack of enforcement action, raises urgent questions about data protection and accountability on platforms like Telegram. Despite previous concerns over the app being used for piracy and unauthorised services, enforcement remains lax.

How to Safeguard Your Data:

• Lock your Aadhaar via the UIDAI website
• Avoid unverified apps and websites
• Never share OTPs or personal data over phone calls
• Be alert to suspicious SIM port or KYC requests
• Audit and minimise your digital footprint
• Report incidents via 1930 or cybercrime.gov.in

This episode underscores the urgent need for stricter digital data regulation and a more accountable approach to platform moderation. Until then, citizens are left to fend for themselves in an ecosystem where their identity can be bought and sold for the price of a cup of coffee.