Telegram’s Dark Trade: Unpacking Brazil’s Data Leak Surge

The exploitation of leaked personally identifiable information (PII) has become a key enabler of social engineering attacks. While dark markets are commonly associated to traditional dark Web forums, Telegram emerges as an easy-to-use meeting place for users and vendors. This study investigates a specific ecosystem within Telegram known as ”Pull Groups” (PG), where large amounts of sensitive personal data are requested and shared. During a six-month monitoring period, we systematically collected and analyzed data, extracting more than 12 million PII records. To assess the potential impact of this exposure, we propose the Leak Exposure Index (LEI), which combines the leak volume with he group size to highlight high-risk environments. Our findings show that a small set of groups are responsible for the majority of leaked data, underlining the need for countermeasures and informed risk assessment strategies. This is also a call for public awareness of this threat.