918 Stolen Databases Just Landed on Telegram for Free

A massive collection of stolen data, previously sold on the criminal marketplace BreachForums, has been leaked openly onto Telegram by a hacker. The dump spans 918 databases and includes some of the most sensitive personal information imaginable: full names, email addresses, account usernames, passwords, payment card details, job titles, and even health information. The organizations whose data appears in this collection include major names like Nvidia, Tesco, Experian, T-Mobile, and LinkedIn, meaning the breach touches virtually every corner of everyday digital life.

What makes this incident particularly alarming is not just the scale, but the accessibility. Data that was previously traded or sold among cybercriminals is now freely available to anyone on Telegram. That shift from paid marketplace to free public dump dramatically lowers the barrier for would-be attackers to exploit it.

From BreachForums to Your Inbox: How Leaked Data Gets Weaponized

BreachForums has long operated as one of the internet's most active stolen data marketplaces. The platform has a turbulent history, with law enforcement actions and internal disputes causing repeated shutdowns and reboots. Most recently, a breach of BreachForums itself exposed the personal details of over 323,986 registered users, adding another layer of irony to a platform built on trading other people's compromised information.

When databases like these are centralized and made freely available, the downstream risks multiply quickly. Cybercriminals can cross-reference email addresses with passwords from multiple breaches to conduct credential stuffing attacks, where automated tools try stolen login combinations across dozens of popular services. Even passwords that appear to be old or already changed can reveal patterns that people reuse across accounts.

Beyond credential stuffing, this kind of data is a goldmine for phishing campaigns. An attacker who knows your name, employer, job title, and email address can craft a convincing message that looks nothing like a generic scam. Add payment card details or health information to that picture, and the potential for targeted social engineering, or even blackmail, increases substantially. Security researchers have also flagged the potential for espionage operations when job roles and corporate affiliations are included in leaked records.

What This Means For You

If your personal information has passed through any of the organizations named in this leak, or through any service that has suffered a historical breach, there is a realistic chance some version of your data is now sitting in one of these 918 databases. That does not necessarily mean you are in immediate danger, but it does mean your exposure has increased.

The combination of data types in this leak is what makes it particularly useful to bad actors. A name and email address alone is relatively harmless. But paired with a job title, a password pattern, a payment card number, or a health record, it creates a detailed profile that can be used to impersonate you, trick you, or gain unauthorized access to your accounts.

Beyond the immediate credential risks, freely available data like this is also used to map user behavior over time. When attackers know where you work, what services you use, and how you tend to structure passwords or usernames, they can track patterns across platforms and target you more precisely. Reducing your digital footprint, using unique credentials for every service, and limiting the personal information you share online all become more important when this volume of historical data is in circulation.

Practical Steps to Reduce Your Risk

You cannot undo a historical breach, but you can limit the damage and reduce your exposure going forward. Here is what security professionals consistently recommend in situations like this:

  • Check your exposure. Services that monitor known breach databases can alert you if your email address or credentials appear in leaked data. Knowing what is out there helps you prioritize which accounts to secure first.
  • Change reused passwords immediately. If you have used the same password across multiple accounts, treat all of them as compromised. A password manager makes maintaining unique credentials for every service significantly easier.
  • Enable multi-factor authentication (MFA). Even if an attacker has your password, MFA adds a second layer of verification that blocks most automated attacks.
  • Be skeptical of personalized messages. Phishing attempts that reference your real name, employer, or other accurate details are a direct consequence of leaks like this. Verify unexpected requests through official channels before clicking anything.
  • Minimize your identifiable footprint online. Using a VPN masks your IP address and prevents websites and trackers from building a behavioral profile tied to your location and browsing habits. This does not prevent credential breaches, but it does limit how much additional data attackers can layer on top of what they already have from leaks like this one.

The BreachForums leak is a reminder that data stolen years ago does not simply disappear. It circulates, gets combined with newer information, and eventually surfaces in forms that are more dangerous than the original breach. Staying ahead of that risk means treating your credentials and personal information as an ongoing security concern, not a one-time problem to solve and forget.