404 Media, working with Court Watch, reported on 16 October that new US court records include a letter from Telegram. The letter gives one user's phone number, user ID and IP address (a number that points to a device online), next to a name. Telegram calls the handover voluntary and says it does not accept US jurisdiction. A related government filing says a judge's order under the Stored Communications Act came first, and the data answered it. The case centers on Mahmoud Amin Ya'qub Al-Muhtadi, who allegedly took part in the October 7 attacks on Israel.
The letter also names Telegram's non-public contact point for US police requests, an email address now in public court records. 404 Media says hackers often pose as law enforcement, often from hacked government email accounts, to trick tech firms into handing over user data. The reporting does not say which court hears the case, when the letter was sent, or how the data was used.
A vendor's channel for police requests is a legal process, and it can also be a way in for impostors. A phone number, user ID and IP address together tie an account to a person and a device. Buyers can ask vendors how they check who is asking, whether they confirm orders with the court, and what changes if a request address leaks.