The illegal sale of personal data through Telegram channels and bots has consolidated in Latin America with prices starting at 3.50 dollars and with access to information as sensitive as ID photos, addresses, financial histories, health data, and family ties. This is reported by the investigation "Identities for sale", prepared between 2024 and 2025 by Derechos Digitales, which places this activity in Argentina, Brazil, and Peru.
The study describes an automated ecosystem in which so-called data brokers market personal information through bots that answer queries with simple commands. Payments are made in cryptocurrencies and also through Mercado Pago. In some cases, it is enough to know a person's name, their DNI number, or a phone number to obtain more associated data.
Automated access to documents, debts and location
Among the data offered are complete ID photos, driver's licenses, private addresses, scanned signatures, employment and financial histories, credit status, and geolocation links. The report maintains that this circuit even allows consulting a person's so-called worst credit situation, the number of banks involved, the amount owed, the monthly commitment, and the evolution of the score over time.
"In other words, this section offers a clear x-ray of the person's financial behavior" - Digital Rights Report
The investigation warns that the ID card can be sold for less than 4 dollars, within a market that also exposes names of direct relatives, complete addresses, and facial photos. The scope is not limited to a specific fraudulent use, but rather, according to the report itself, opens the door to forms of violence facilitated by technology.
"The risks derived from this illegal market are not merely technical. The availability and circulation of personal data on Telegram has empowered forms of violence, including gender-based violence facilitated by technologies and the exposure of girls, boys, and adolescents" - Digital Rights Report
State Leaks and Exposed Databases
The report links part of the information circulating in these channels with major previous leaks. Among them, it cites the exposure of 116,000 Renaper photos in 2021 and another leak from the same agency in 2024 that exposed 65 million records. It also mentions the theft of 6 million driver's licenses and the publication of PAMI records.
Many of the data sold would also come from Nosis, a company that suffered a leak in 2024. Rafael Bonifaz, head of the Latin American Program for Digital Resilience and Defense of Digital Rights, points out that there are coincidences between the commercialized material and databases that could be in the hands of public bodies.
"There are coincidences with the formats, database structures and the type of information that state agencies could be expected to have" - Rafael Bonifaz, Derechos Digitales
Bonifaz underlines that the problem fully reaches the citizenry due to the low cost of access to these data and due to the ease with which different sources can be crossed.
"Just by knowing the name, the DNI number or a phone number, information such as residence, CUIL, credit history, debts, names of family members and full address can be obtained, which on some occasions includes links to Google Maps" - Rafael Bonifaz, Digital Rights
Criticism for the weakness of data protection
Beatriz Busaniche, from Fundación Vía Libre, considers that this scenario reflects a structural weakness in data protection in Argentina. The entity sued the National State in 2024 for the lack of care of information after the Renaper leak.
"This shows the systemic fragility of the data protection ecosystem in Argentina. The State centralizes information that we cannot manage differently and is not under appropriate custody" - Beatriz Busaniche, Fundación Vía Libre
Busaniche also questions that there is accessible economic information with a level of detail that, in his opinion, invades the privacy of citizens who are not public figures. In his view, the problem is not reduced to the risk of scams or extortions, but to the commercial value that these data acquire when exploited on a large scale.
Telegram defends its moderation system
Telegram maintains that sharing private data is prohibited by its terms of service and assures that such content is deleted as soon as it is detected. The platform states that its moderators, supported by artificial intelligence tools, proactively monitor public sections and process reports to remove harmful content.
"Sharing private data is explicitly prohibited by Telegram's terms of service, and such content is deleted as soon as it is discovered" - Telegram
The company adds that during this year it has blocked more than 9.5 million groups and channels for violating those rules. Even so, Digital Rights demands greater transparency regarding the activity of the platforms, with periodic reports on the removal of illicit content, compliance with judicial orders and the functioning of automated systems such as bots.
The debate on intelligence and democratic control
The report also warns that the transfer of cybersecurity policies to the scope of SIDE introduces more opacity and hinders accountability in the face of massive privacy violations. That criticism is framed within the reform of the intelligence system approved through a decree of necessity and urgency published on January 2 by the Government of Javier Milei.
That decree enables intelligence personnel to apprehend people in certain circumstances, such as cases of flagrancy or specific tasks linked to national security. For Busaniche, the problem is not limited to that specific point, but to the lack of effective controls over the use of data and over the actions of intelligence services, whose only oversight body is the bicameral commission of Congress.
The investigation concludes that the illegal market for personal data does not operate on the margins of the internet, but supported by massive leaks, automated channels, and an accessible payment infrastructure. The result is a constant exposure of intimate information that can be bought at a very low price and circulate rapidly outside of any effective control.