They warn that Telegram bots auction off Renaper data, addresses and even financial histories

“Identities for sale”, carried out by the organization Digital Rights between 2024 and 2025, identifies an automated ecosystem, which means that the sale is usually not manual but is carried out through bots that answer queries. Through digital payment schemes, ranging from crypto to Payment Marketprovide immediate access to citizen information.

The information for sale includes complete photos of the DNI, driver’s licenses, private addresses, financial and employment histories, health information and even commercial links. This data is then used to commit different types of cybercrimes, from identity theft to extortion.

“The risks derived from this illegal market are not merely technical. The availability and circulation of personal data on Telegram has promoted forms of violenceincluding gender violence facilitated by technologies and the exposure of girls, boys and adolescents. These facts show how data exploitation intersects with pre-existing structures of inequality and power, becoming a mechanism of control, silencing and re-victimization,” the report says.

The study warns that with fairly simple commands it is possible to access a total x-ray of the victim: facial photos, scanned signatures, geolocated addresses, debt histories and direct family ties.

This “identity on demand” ecosystem is marketed at marginal prices, with plans that start in the $3.50 and they are paid through common platforms such as Mercado Pago or cryptocurrencies, which are more effective in hindering the traceability of transactions.

Another issue that the report highlights is that it can be access the person’s credit situation, the “worst situation” registered, the number of banks involved, the total amount owed, the monthly commitment (ratio between income and debt), the credit score, and its trend over time. “In other words, this section offers a clear x-ray of the person’s financial behavior,” the report says. Much data is taken from The nosea company that collects this data and which suffered a leak in 2024.

In this sense, the report links the sale of this data with the leaks that occurred during these years in State agencies: high-impact incidents, such as the exhibition of 116 thousand photos of the Renapper In 2021, the massive leak of the same organization in 2024 that exposed 65 million records, the theft of 6 million driver’s licenses and the publication of PAMI records operate as clues as to where the information could come from.

While it is impossible to confirm that the information comes out of these leaks with complete certainty, “There are coincidences with the formats, structures of databases and the type of information that state agencies might be expected to have,” he explains to Clarion Rafael Bonifaz, Leader of the Latin American Program for Resilience and Digital Defense, of Digital Rights.

The specialist warns: “In the case of citizens, it is important to know that their data can be accessible to third parties at a very low cost. By simply knowing the name, DNI number or a telephone number, information such as residence, CUIL, credit history, debts, family names and full address can be obtained, which sometimes includes links to Google Maps.”

One of the most striking issues is how simple it is to access these Telegram bots. The company, contacted by this means, said that “sharing private data is explicitly prohibited by Telegram’s terms of service, and such content is removed upon discovery. “Moderators, supported by customized AI tools, proactively monitor the public sections of the platform and accept reports to remove millions of harmful content every day, including the dissemination of private data.”

In addition, they recalled that this year, “more than 9.5 million groups and channels have been blocked for violating the terms of service” of the platform. However, it is known that these channels they usually reappear (“respawn”, in the slang) under other names and that buyers have techniques to easily identify them.

Bonifaz believes that “it is important to demand greater transparency about the activity of the platforms, for example by publishing periodic reports with information on the removal of illicit content, compliance with court orders and the operation of automated systems, such as bots,” he says. Telegram periodically publishes this type of reports.

“Another central point is to guarantee that platforms like Telegram have effective reporting and rapid response channels. In the case of foreign platforms (such as Telegram in relation to Argentina), this implies requiring that they designate legal representatives in the country, capable of responding to the authorities,” concludes Bonifaz.

Beatriz Busanichefrom the Vía Libre Foundation, an organization that has been denouncing the lack of protection of personal data in Argentina for more than two and a half decades, warns in dialogue with Clarion: “This shows the systemic fragility of the data protection ecosystem in Argentina. The State centralizes information that we cannot manage differently and is not in proper custody. The basis of Anses is our income and debts: just by knowing a person’s CUIT you can enter the Central Bank and see how much they consumed with their card each month. “It is public information that should not be.”

In 2024, in fact, the organization sued the National State for the lack of care of the data, due to the Renaper leak, one of the largest in the country.

“Data has a high value in the market when it is put in volume. We are not really aware of what this means, not only because of possible scams or extortion, but because of privacy. That the Central Bank publishes how much I spent on the card seems like a total violation to me: I am not a public person or debtor. It makes no sense for the State to display that data. We have a serious problem in every sense,” he adds.

The Digital Rights report goes beyond the commercialization of data: it points to the institutions behind this problem. There he warns about the transfer of cybersecurity policies to the orbit of the SIDE (Secretary of State Intelligence) introduces a factor of opacity that hinders democratic control and accountability in the face of new massive privacy violations.

“To this structural problem of issues linked to data held by the State, we add the other side that has to do with security agencies and intelligence agencies that introduce a factor of opacity that makes democratic control over what happens with our data difficult,” says Busaniche.

“In the last decree on intelligence services, where their functions are modified, in general a lot of focus was placed on having attributed to SIDE employees the power to detain people without a court order, which is an aberration from the point of view of the rule of law,” he continues.

His reference is to the Decree of Necessity and Urgency (DNU) published by the Government of Javier Milei on January 2, where the Executive Branch ordered a comprehensive reform of the intelligence system, with an article that enables intelligence personnel to “apprehend” people in certain circumstances, such as in cases of flagrancy or in the framework of specific tasks linked to national security.

“But there is also the growing opacity in the use of the intelligence services, which has several characteristics: opacity, the discretion of the reserved funds and the total lack of control. We must always remember that the only control body that the intelligence services have It is the bicamerala commission made up of senators and deputies that is the only one with the power to exercise effective control over them,” Busaniche closes.

Reports like the Digital Rights report help provide transparency in an ecosystem that is generally quite dark.