It isn’t just a hunch. A study examined how the illicit data market operates via Telegram in Latin America, and the findings are disturbing. In at least 27 active groups on this platform in Brazil, Peru, and Argentina, a 24-hour marketplace for buying and selling sensitive personal data was identified. What’s most alarming is that many of the buyers use this data as a weapon against women and children. In short, it’s a digital black market that contributes to gender-based violence.
“Identities for Sale,” the title of a study conducted by the NGO Derechos Digitales, analyzed groups in these three countries between October 2024 and February 2025 and found that through bots — and in some cases, humans — and via digital payment systems, sensitive personal data on this platform can be accessed immediately. With just one click, the identities of Latin Americans are being traded.
“The sale of personal data has become a lucrative business within the underground digital economy: identity documents, phone numbers, home addresses, financial and health records, and information about family members circulate on Telegram without consent and expose millions of people to various types of risks,” the study states.
Most concerning is that there are indications that some of the information circulating may originate, directly or indirectly, from public databases or official records. This is one of the most serious findings because it highlights vulnerabilities in government information management at a time of increasing digitization of public services and as governments in the region collect ever-growing volumes of citizen data.
For Paloma Lara-Castro, director of public policy at Derechos Digitales and coordinator of the research, the phenomenon lays bare Latin America’s great structural fragility regarding data management—a lack of a solid culture that manifests in regulatory, institutional, and information security vulnerabilities. “In terms of regulations, there are gaps and data protection laws that are disconnected from cybersecurity laws; institutional weaknesses stem from the fact that the authorities responsible for enforcing these regulations generally lack the independence, resources, or capacity to oversee the state itself,” she explains.
The vulnerability in security, the lawyer adds, is that state governments handle large volumes of information, but this is not accompanied by robust security policies, “given the structural factors in Latin America, where there is a long history of data breaches.”
How the illegal market operates
Telegram was launched in 2013 and was created by Russian brothers Pavel and Nikolai Durov. It was presented as an alternative messaging platform free from government surveillance and with minimal content moderation, but the app’s features make it appealing for clandestine activities. Not only has it become a hub for mass disinformation, but it is now considered a favorite among cybercriminals. “It allows users to interact anonymously on the platform and to disseminate information on a massive scale,” explains Lara-Castro regarding one of the features of this app, which has grown in popularity in Latin America, with Brazil, Mexico, and Colombia leading in downloads.
However, it is automation — or the use of bots capable of performing tasks without direct human intervention or supervision — that has the greatest impact on illicit activities carried out via Telegram. Automation was designed to improve the user experience, but it quickly became the preferred method for criminals to buy and sell personal data.
“They operate using predefined commands, integrating with external databases to deliver results instantly,” the document states. Thus, these bots allow cybercriminals’ clients to manage queries and access sensitive data, ranging from identification numbers to criminal or financial records.
The illegal market operates under the “freemium” business model — offering free trials before selling plans — which employs marketing strategies tailored to the illicit market and legal payment methods widely used in these countries, such as virtual wallets. While access prices varied by country, researchers found that in these groups, data sales ranged from $1 for weekly plans or access to $116 for a year, as found in Peru, which was the highest price recorded throughout the study.
“We can really see a disturbing level of access to the amount of data linked to an individual with varying degrees of exposure. From facial images — since it also includes photos — to geolocated information and even individual and family financial and employment histories. What concerns us is that identity is becoming a commodity of economic value, traded illegally,” says Lara-Castro.
Brazil, Peru, and Argentina
The study tracked 27 active channels where identity is marketed in Brazil, Peru, and Argentina, though these are not the only ones. This sample allowed the researchers to conduct a sustained analysis and draw comparisons.
Findings from Brazil, where Telegram is one of the most popular apps, indicate that there is a “high degree of automation in management” and that every channel has an administrator, ensuring constant attention to data requests. “This structure enables the group to function like a 24-hour store, with pre-set operational commands for conducting searches or making purchases,” the study states.
There, cybercriminals were selling everything from civil identification numbers and tax identification numbers — administered by the Brazilian Federal Revenue Service — to vaccination data and estimates of the target’s monthly income, as well as classifications of their purchasing power.
“This classification may come from tax or consumption records and can be used to infer the socioeconomic status of the affected person, exposing them to risks of discrimination, stigmatization, and practices of exclusion or exploitation for financial gain,” the study warns.
But that wasn’t the only data for sale on that marketplace; information such as work ID numbers and Social Security numbers was also circulating, as well as registered addresses that extended not only to the person in question but also to their immediate family and even their neighbors. They found something similar in the Peruvian groups, where bots also allowed access to biometric data, such as people’s fingerprints and, in some cases, photos and signatures.
“The bots disclose data on people residing in the vicinity of the person being searched. The inclusion of these third parties broadens the scope of the data breach and could facilitate the creation of relational profiles capable of mapping family and community ties, which could eventually be combined with other data for purposes such as targeted fraud, identity theft, extortion, or surveillance by non-state actors.”
A weapon used by perpetrators of violence against women
Lara-Castro points out that there is another critical aspect of data exposure: technology-facilitated gender-based violence. In 2024, a group of 70,000 men on Telegram was documented exchanging information on how to drug and rape women, and even the app’s founder, Pavel Durov, was arrested as part of an investigation into crimes facilitated by the platform, such as the distribution of child sexual abuse material. In Peru as well, information purchased on the app was used to threaten journalists.
“We have documented some cases in which data obtained through Telegram is used to extort a victim for sexual purposes or, at times, as retaliation to silence people who have reported gender-based violence,” says the researcher, and points to the impact this could have on children and adolescents, since buyers not only access a person’s data but also that of their family environment, which includes minors.
The study highlights an alarming case of data leakage involving children in the groups analyzed in Argentina, where an image of a teenage girl is shown alongside data such as her name, ID number, and date of birth, with a watermark indicating the Federal Police Communications System (SIFCOP). That system is a restricted official tool, used exclusively for the exchange of information of criminal interest between police forces and judicial bodies, the researchers explain. “Access to it is governed by strict protocols, which makes the potential leak that occurred all the more serious.”
“The sale of their data and the use of hypersexualized imagery in Telegram groups and channels reinforce illegal practices and increase the risks to their safety and that of their families,” the document states.
The groups in Argentina also exhibited a different pattern from those in the other countries evaluated. While bots dominate in Peru and Brazil, Argentine groups feature more “human sellers” and prioritize “direct and discreet” communication between sellers and buyers who use tokens as an internal currency. In addition to personal data, the leakage of business data was also documented.
Paradoxically, Argentina was one of the first countries to enact robust data protection laws; however, these have been jeopardized by reforms to cybersecurity governance during President Javier Milei’s term, according to Derechos Digitales.
The research emphasizes the responsibilities of states and recommends that they improve regulatory frameworks that are outdated in light of current problems; create protocols to assist and compensate victims whose data is circulating on the black market; effectively integrate a gender perspective into data protection and cybersecurity policies; and establish design rules, commercial restrictions, and age-appropriate protection services to prevent the leakage of minors’ data.
