Ransomware victim disclosure
← All victimsVahid Online (Telegram Channel)
listed as Vahid Offline Members · Claimed by Handala · listed 3 months ago
Status timeline
- Listed
Mar 17, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileVahid Online appears to be an Iranian Telegram channel or online community with approximately 180,000 members. The channel's nature is not fully specified, but it operates as a digital membership-based platform in Iran. No corporate website or physical presence has been identified.
- Industry
- Online Media / Social Channel
Attack summary
Severity: high — Confirmed exfiltration and publication of PII (names and mobile numbers) for 180,000 individuals constitutes a large-scale personal data breach; mobile numbers linked to Iranian users carry significant privacy and safety risks in the local context.Handala claims to have exfiltrated and published a list of 180,000 Iranian members of the 'Vahid Online' channel, including their associated mobile phone numbers.
Data the group says was taken
AI dossier — extracted from the leak post- Member list (180,000 individuals)
- Mobile phone numbers
What the group claims
The list of 180,000 Iranian members of this channel, along with their mobile numbers, has been published. From now on, you’d better change your name from “Vahid Online” to “Vahid Offline”! Download Members
Sources
Source
Indexed 3 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.
