Telegram Channel Leaking Your Personal Data? Report It

Someone sends you a screenshot, or you stumble on it yourself: your name, MyKad (IC) number, phone and home address sitting in a public Telegram channel, next to thousands of other people's. In BM people search this as "data peribadi bocor di Telegram". It feels exposed and out of your hands.

The short answer: report the specific messages to Telegram, send its takedown address the exact links, and file reports with the Malaysian agencies that handle leaks. At the same time, assume the details are now known to scammers and close the doors they open.

This guide covers what to capture, where to report inside and outside Telegram, what each leaked detail can be used for, and the scams that tend to follow a leak.

Last checked: 5 October 2026.

#How Do You Report a Telegram Channel Leaking Your Personal Data?

Telegram's FAQ says every Telegram app has a "Report" button for illegal content: tap the message on Android, press and hold it on iOS, or right-click it on desktop and web, then choose a reason. It also gives an automated takedown address, [email protected], and asks that the email include links such as t.me/... or @... to the exact content. Do both. In Malaysia, report the leak to CyberSecurity Malaysia's Cyber999 and lodge a complaint with MCMC, attaching your Telegram report details. If the data is being used to threaten you or to cheat you or others, make a police report. Telegram decides what it removes, and no one outside Telegram can delete a channel for you.

#Do Not Go Looking for the Rest of the Leak

It is natural to want to see everything that was posted. Resist it.

• Do not download the leaked file, even to check what it contains. It holds other people's personal data, and handling it puts you in a difficult position.
• Do not pay a channel or bot to "look up" your IC number. Lookup services built on leaked data are part of the same trade, and your query tells them you are interested.
• Do not message the channel owner or argue in the comments. It confirms that the data is live and can make you a target.
• Do not pay anyone who offers to delete the data. A third party cannot remove another person's channel, and copies may already be elsewhere.

#Capture the Evidence Before It Moves

Leak channels are deleted, renamed and reposted often. Capture what you can see once, so every report points at the same facts. Keep other people's records out of your screenshots where you can.

#Report It Inside Telegram First

The in-app report goes straight to Telegram's moderators. Its moderation page says reports from users are combined with proactive monitoring, and that you can add a comment when you report a message.

1. Open the message that contains your details.
2. Tap it (Android), press and hold it (iOS), or right-click it (desktop or web), and choose "Report".
3. Pick the reason that fits best. The options vary by app version, so choose the one closest to personal data or privacy if your version shows it, otherwise the closest illegal content option.
4. Add a short comment where the app allows it, for example: "This post publishes my national ID number, phone and home address without consent."
5. Repeat for each message that carries your data, rather than reporting only the channel.

Report once per message, honestly. Do not ask friends to mass-report or pick a reason that does not apply.

#Email Telegram's Takedown Address

Next, send one clear email to [email protected]. Telegram's FAQ describes it as an automated takedown address and asks for links to the content. Its Terms of Service prohibit activities recognised as illegal in most countries, and its FAQ says it performs legal checks on reports about public channels and takes content down when it deems it appropriate.

• Subject line: a plain description, such as "Public channel publishing personal data, including national ID numbers".
• The exact t.me message links, one per line, and the channel's @username.
• Which details are yours (name, ID number, phone, address) and that you did not consent to their publication.
• Whether the channel appears to share or sell bulk records belonging to many people.
• Any police or agency reference number you already have.

Keep the email factual. You do not need to attach the leaked file, and you should not. If someone has also set up an account pretending to be you, Telegram's FAQ points to @NoToScam for that, and our guide to a fake Telegram account impersonating you covers it in full.

#Where to Report a Data Leak in Malaysia

Telegram is one route. Malaysian agencies handle different parts of the problem, and MCMC's own complaint guidance says it is not the only agency that can act on online content. This is general information, not legal advice; a lawyer can tell you how the law applies to your situation.

Cyber999's reporting page lists data breach among the incidents it treats as an emergency, and CyberSecurity Malaysia describes Cyber999 as the national point of contact for computer security incidents. Mention the Telegram links and what was exposed.

MCMC's guidance says to report to the platform first, then lodge a complaint at aduan.mcmc.gov.my with detailed information, supporting documents and copies of what you sent the platform. It says you will receive a reference number when you submit. The same page maps data breaches to the Personal Data Protection Act 2010 and the Personal Data Protection Department, and threats to life or property, hacking and cheating by personation to the police.

MCMC says the Online Safety Act 2025 came into force on 1 January 2026 and places duties on licensed messaging and social media providers. MCMC describes it as a framework for regulating those providers; its overview does not describe a separate takedown route for individuals.

If the leak is part of harassment aimed at you personally, our guide to making a police report for online harassment explains what to bring.

#What Each Leaked Detail Lets Someone Do

Reporting reduces exposure. It does not pull the data back from people who already copied it. Plan as if the details are known, and match your response to what leaked.

#Damage Control for the Next Few Weeks

1. Call your bank using the number on your card or the official app, say your ID details were leaked, and ask what extra checks they can add.
2. Check your bank and e-wallet transactions daily for a few weeks.
3. Change any password that appears in the leak or that you reused, starting with your main email. Our guide to checking whether your password was leaked walks through it.
4. Turn on two-factor authentication for email, banking, Telegram and your social accounts. On Telegram, Telegram's FAQ points to 2-Step Verification under Settings, then Privacy and Security.
5. If your phone loses signal for no clear reason, act fast. Our article on SIM swap attacks in Malaysia covers the carrier call.
6. Warn family members that scammers may call them using your name and details.

#Scams That Tend to Follow a Leak

Real details make scams more convincing. Watch for a caller posing as police, a bank or a court who recites your IC number, a fake courier message using your real address, and offers to "remove your data from Telegram".

• A caller knowing your IC number proves nothing. Hang up and call the organisation back on a number you find yourself.
• Nobody legitimate asks for your banking password, OTP or a transfer to a "safe account".
• Telegram login codes arrive by SMS or in the official "Telegram" chat, and Telegram's FAQ says they should never be shared with anyone.
• No one can promise to wipe leaked data from the internet. Anyone selling that is selling nothing.

If you have already lost money, the government's NSRC 997 page says to call 997 within 24 hours of discovering the scam, contact your bank, and make a police report.

#What Reporting Can and Cannot Achieve

Be realistic about the outcome. Telegram reviews reports and decides; its FAQ says it takes down public content when it deems it appropriate after legal checks. A channel may be removed, a single post may go, or nothing may visibly change. Agencies investigate on their own timelines, and a leak that has been copied into other channels or files cannot be fully recalled.

So the protective steps matter as much as the reports. A removed channel limits who sees your data next; a secured bank account and email stop it being turned into money.

#When a Case Review Makes Sense

Most people can file these reports themselves, and only Telegram and the authorities can act on them. Outside help is worth considering when the leak is tied to targeted harassment, when your details sit in several channels at once, or when you run a business whose customer records appear to have leaked. SocialSafe by AwareXone, our recovery and digital identity service, looks at the case first, prepares rights-based reports through Telegram's own channels and the proper agencies, and never files false or exaggerated claims. It cannot promise removal, and it will never ask for your passwords or codes. The content removal service page explains how a review works, and our Trust Center sets out how we handle your information.

#Frequently Asked Questions