Telegram account hacked: what to do now

The first five minutes

1. Open Telegram on a device where you were already signed in. Keep that trusted session available.
2. Open Settings → Devices. Find sessions you are certain do not belong to you.
3. Terminate unfamiliar sessions. Capture evidence only if it does not delay containment.
4. Secure the two-step verification password and its recovery email. Follow the options Telegram makes available to your account.
5. Check the administrators of channels and groups you own.

A login attempt is different from an active intrusion

• An unexpected login code means someone requested a sign-in. The code alone does not prove they got in. Never share it.
• A new-login notification means an authorization occurred. Check whether it was your own sign-in.
• A session you have established is not yours means that device currently has account access.
• Messages you did not send show that harm may already have occurred. Also check whether someone is impersonating you with a separate account.

How to read the device list

If a trusted, older session is available

Use that session to terminate the unfamiliar entries. Terminating one session leaves the others signed in. Terminate All Other Sessions closes every session except the one you are using; your own other devices will need to sign in again.

Enable or change two-step verification, secure the recovery email and check control of your phone number with your mobile provider. Changing a password does not close sessions that are already authorized.

If you have just signed in again

Telegram blocks a session from terminating other sessions for the first 24 hours after its own login. The age of the session you want to terminate does not determine this restriction.

Look for a phone, tablet, computer or browser where you have been signed in longer. While the restriction applies, secure available password and recovery settings, review connected services and warn affected contacts through a trusted channel.

Understand the 24-hour restriction

If you cannot access the account

Follow the sign-in and recovery options shown by the official Telegram app. A two-step verification recovery email can help with the password when it was configured and remains under your control.

If you no longer control the phone number, contact your mobile provider. For unresolved access problems, use Telegram's official support. Cerber and third-party recovery services cannot bypass Telegram's authorization rules.

Telegram support

Review what changed after containment

Removing a Telegram session does not undo changes already made or recall information already copied. Do not rely on third parties to recover messages deleted from Telegram.

• Outgoing messages, Saved Messages and documents that may have been exposed.
• Channel posts, pinned messages and invite links; revoke compromised invite links.
• New administrators and altered permissions in groups and channels.
• Connected websites, bots with administrative access and other separately granted permissions.
• Your name, username, photo, profile details and phone-number settings.
• Connected payment services or wallets: secure them through their own controls.

Warn contacts with a clear message

You can adapt this message: My Telegram account was compromised. Please ignore recent requests for money, login codes or links sent from it. Verify any urgent request with me through another channel.

For a work account, assign an incident owner and contact affected colleagues, customers and counterparties. Verify payment instructions independently before acting on them.

Protection for company Telegram accounts