Instant messenger identities leaked: what it means and what to do
Risk level: low. Can you change it: yes. Found in 8 breaches in this directory.
What this data is
Usernames or IDs for messaging services such as Telegram, Discord, WhatsApp, Signal or Skype, or older services such as ICQ and AIM, stored in profile fields or contact records.
The risk on its own
Low risk. A messenger handle is meant to be shared so people can reach you, and it cannot log in to your account. It does give strangers a direct line to you that bypasses email spam filters.
The risk combined with other data
With your name and email, it lets scammers reach you on a platform where messages feel personal and filtering is weaker. A handle reused across services also links your accounts together. On older services, the handle can point to an old email address that is still tied to your other accounts.
How criminals use it
A scammer messages you on Telegram posing as an investment adviser or recruiter who found you through a mutual contact.
A Discord or gaming handle is linked to your real name and used for harassment.
Someone registers a near identical handle to impersonate you to your contacts.
What to do now
Limit who can reach you: in Telegram open Settings, Privacy and Security and restrict who can find you by phone number or add you to groups; in WhatsApp turn on Silence Unknown Callers.
Ignore unsolicited investment, job or romance messages from people you do not know.
Turn on two-step verification in each messaging app, such as a Telegram password or a WhatsApp PIN.
Use different handles on accounts you want kept separate.
Report impersonation accounts to the platform.
Frequently asked questions
Can someone hack my messenger with my username?
Not with the username alone. Protect the account with two-step verification so a stolen SMS code or password is not enough.
Why am I getting messages from strangers?
Leaked handles are added to scam contact lists. Restrict who can contact you, and block and report unsolicited messages.
Should I change my handle?
Only if you are being targeted or want to separate accounts. Most people just need to tighten privacy settings.
Breaches that exposed this data
Black Hat World: 2014-06-23, 777K accounts, Dates of birth, Email addresses, Instant messenger identities, IP addresses, Passwords, Usernames
Android Forums: 2011-10-30, 745K accounts, Dates of birth, Email addresses, Homepage URLs, Instant messenger identities, IP addresses, Passwords
vBulletin: 2015-11-03, 519K accounts, Dates of birth, Email addresses, Homepage URLs, Instant messenger identities, IP addresses, Passwords
Cannabis.com: 2014-02-05, 228K accounts, Dates of birth, Email addresses, Geographic locations, Historical passwords, Instant messenger identities, IP addresses
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.