A Telegram people-search bot data leak has put the personal details of Belarusians who used a state appeals service within reach of anyone with a phone. According to the publication Zerkalo, as reported by Nasha Niva, data of people registered in the service Obrashcheniya.bel became available through the popular Telegram bot Sherlock, which is used to look up personal information.
The source text available to us is brief, so this post sticks to what has been reported and explains why the pattern matters.
What leaked from Obrashcheniya.bel
Obrashcheniya.bel is a service for electronic interaction with state bodies. Citizens use it to submit appeals to government institutions. According to the report, personal data of people registered in this service became accessible through Sherlock.
The reporting does not, in the portion we have, detail exactly which fields were exposed, how the data left the platform, or how many accounts are affected. We are not going to guess at those points. What is clear is that records tied to a government-run platform ended up in a tool that is open to ordinary users of Telegram.
That detail is the heart of the story. A government service collects data for a narrow purpose: handling an appeal. Once the same records appear in a general lookup tool, they serve a much broader audience, and the people in them have no say in who searches for them.
How the Sherlock bot made the data searchable
People-search bots on Telegram work like a search engine for personal records. A user types in a name, phone number or other identifier, and the bot returns whatever matching information its operators have collected. The data typically comes from many sources, including leaked databases, and is merged into one convenient index.
This is what makes a leak more damaging over time. A raw data dump is awkward to use. It may require technical skill to download, open and query. A bot removes that barrier. Anyone can run a search in seconds, with no tools beyond a chat window. In effect, the bot turns a leak into a public utility for whoever wants to find a specific person.
According to the report, Obrashcheniya.bel data became searchable this way. Once records are inside such an index, deleting them at the source does not necessarily remove them from the bot, since copies may already have been collected.
Who is exposed and what the risks are
The headline of the original report notes that well-known propagandists were among those exposed. That is a reminder that this kind of leak does not discriminate. Ordinary citizens who filed routine appeals sit in the same searchable index as high-profile public figures.
For most people, the practical risks are familiar:
- Targeted phishing and scams. Attackers who know your name and details from a government service can craft convincing messages that appear to come from an official body.
- Doxxing and harassment. Searchable personal data makes it easier for someone with a grudge to locate or pressure a person.
- Profiling. Records tied to a state platform can reveal that a person contacted authorities, which may be sensitive in itself depending on the context.
We stress that these are general risks of exposed personal data, not confirmed incidents linked to this specific leak.
The pattern is not unique to Belarus. Once records leave the source system, they tend to circulate widely, as seen in our coverage of the Maxia Latam breach that allegedly exposed Panama CSS data, where claimed data from a service provider surfaced in underground listings.
How to check and limit your exposure
You cannot fix a leak at a government platform yourself, but you can reduce the damage.
- Search for yourself. Look up your name, email address and phone number in search engines and in breach-notification services to see where they appear.
- Change and separate credentials. If you used a password on a government portal that you reuse elsewhere, replace it everywhere and use a password manager to keep each one unique.
- Turn on two-factor authentication on email and messaging accounts, since those are the usual targets after a leak.
- Treat unexpected contact with suspicion. Messages that quote your personal details are not proof of legitimacy. Verify through an official channel you find on your own.
- Limit what you share. Provide only the information a service requires, and avoid putting extra details into appeal forms.
- Adjust Telegram privacy settings. Restrict who can see your phone number and profile details.
A VPN hides your traffic from your network and masks your IP address, but it does not remove data that has already been collected and indexed. It is one layer of privacy, not a fix for this kind of exposure.
What This Means For You
If you are registered on Obrashcheniya.bel, assume your details may be searchable and act accordingly: tighten account security and be wary of tailored messages. If you are not, the lesson still applies. Any service that holds your data can become the starting point for a searchable record, and the people-search tools that aggregate it are outside your control.
Takeaways
- Check what is findable about you in people-search tools and breach listings, and repeat the check periodically.
- Use unique passwords and two-factor authentication everywhere.
- Be skeptical of messages that know too much about you.
- Read our Maxia Latam breach coverage for another example of how leaked records travel once they leave the source system.
The Telegram people-search bot data leak tied to Obrashcheniya.bel is a clear example of why personal data hygiene matters. You cannot control every database that holds your information, but you can make what leaks far less useful to anyone who finds it.
