Loading signal...
Signal
Submitted
May 20, 2026, 21:03 UTC
Independent cybersecurity review confirms Telegram exposes persistent device identifiers allowing passive user tracking, linked to a Russian engineer with alleged FSB ties.
An independent cybersecurity review conducted by Symbolic Software and obtained by Important Stories confirmed that Telegram exposes a persistent device identifier known as 'auth_key_id' in its network traffic. This identifier remains stable across sessions, IP changes, network switches, and geographic locations, allowing passive tracking by entities with access to network traffic without breaking encryption. OCCRP and Important Stories' 2025 investigation connected this vulnerability to Telegram's infrastructure and a Russian network engineer, Vladimir Vedeneev, who had ties to the FSB and served as Telegram's CFO with signing authority. Vedeneev denied the vulnerability's existence and connection to FSB. Telegram rejected the review's conclusions, asserting the 'auth_key_id' changes regularly and no user data is revealed, also denying FSB links. This vulnerability could enable state surveillance systems, ISPs, or network administrators to track users across locations and time if identities are known by other means.
Confidence: High
The confirmed exposure of persistent device identifiers in Telegram network traffic enables passive tracking and surveillance by state actors. The involvement of a key Telegram figure with known FSB ties and the potential for state surveillance aligns with hostile cyber espionage activity characteristic of aggression in hybrid warfare.
Source URL
https://www.occrp.org/en/news/review-confirms-telegram-tracking-vulnerability
Source reliability
C
Info credibility
3
Event time
May 19, 2026, 00:00 UTC
Event time confidence
unknown
Location
Russian Federation
Primary actor
Vladimir Vedeneev
Country
Russian Federation
Tags
Telegram, cybersecurity vulnerability, user tracking, Russian state surveillance, FSB, offensive cyber operations
Signal
Submitted
May 20, 2026, 21:03 UTC
Independent cybersecurity review confirms Telegram exposes persistent device identifiers allowing passive user tracking, linked to a Russian engineer with alleged FSB ties.
An independent cybersecurity review conducted by Symbolic Software and obtained by Important Stories confirmed that Telegram exposes a persistent device identifier known as 'auth_key_id' in its network traffic. This identifier remains stable across sessions, IP changes, network switches, and geographic locations, allowing passive tracking by entities with access to network traffic without breaking encryption. OCCRP and Important Stories' 2025 investigation connected this vulnerability to Telegram's infrastructure and a Russian network engineer, Vladimir Vedeneev, who had ties to the FSB and served as Telegram's CFO with signing authority. Vedeneev denied the vulnerability's existence and connection to FSB. Telegram rejected the review's conclusions, asserting the 'auth_key_id' changes regularly and no user data is revealed, also denying FSB links. This vulnerability could enable state surveillance systems, ISPs, or network administrators to track users across locations and time if identities are known by other means.
Confidence: High
The confirmed exposure of persistent device identifiers in Telegram network traffic enables passive tracking and surveillance by state actors. The involvement of a key Telegram figure with known FSB ties and the potential for state surveillance aligns with hostile cyber espionage activity characteristic of aggression in hybrid warfare.
Source URL
https://www.occrp.org/en/news/review-confirms-telegram-tracking-vulnerability
Source reliability
C
Info credibility
3
Event time
May 19, 2026, 00:00 UTC
Event time confidence
unknown
Location
Russian Federation
Primary actor
Vladimir Vedeneev
Country
Russian Federation
Tags
Telegram, cybersecurity vulnerability, user tracking, Russian state surveillance, FSB, offensive cyber operations