Discord, Telegram, and apps like them
Popular chat apps feel private because the UI is smooth. Privacy is not the UI. The last couple of years made that hard to ignore.
The shared pattern
These products are big clouds with big ecosystems. Bots. Support vendors. Invite links. Marketplace culture. Each extra piece is another place your data can leak, or another place an attacker can stand.
That does not mean every user is doomed. It means the default trust model is soft. You are trusting the vendor, their vendors, and a long tail of third-party code.
Discord
In late 2025 Discord reported a serious incident that was not a break of Discord’s core chat store. Attackers hit a third-party customer support provider. Support tickets and related user data were exposed. That included contact details, limited billing hints, IPs, and for some people government ID photos used in age appeals. Passwords were not in that pile. Full card numbers were not either. It was still a sharp reminder. The people who contacted support handed sensitive proof to a vendor chain. That chain broke.
There is a second Discord problem that never really stopped. Malware and account theft. Stealers go after Discord tokens on the desktop client. Fake “verify” bots and hijacked invite links pull people into bad servers. From there they ask you to run a command, download a file, or paste something into a terminal. That path has been used for credential theft, crypto wallet theft, and remote access malware. Community size is the feature. Community size is also the attack surface.
Bots add another cut. When a popular server bot gets breached, usernames, IDs, emails, and IPs can spill even if Discord itself held the line. Your risk is not only the main app. It is everything you authorize inside it.
Telegram
Telegram markets itself as a privacy product. The default chat mode is still cloud chat. Cloud chats are encrypted between your client and Telegram’s servers. Telegram can read them. That is how multi-device sync works. It is also why “encrypted” in the marketing sense is easy to misunderstand.
Secret chats are the end-to-end option. Many people never turn them on. Groups and channels live in the cloud model. If your team’s real work is in a big group, you are not in the secret-chat world.
Researchers keep pressure on MTProto and on third-party clients that implement it poorly. Replay bugs and fragile client code matter because the ecosystem is large. A weak client can hurt more than its own users when the protocol and culture encourage lots of alternate apps.
Phone numbers as identity, contact syncing, and public channels also shape the privacy story. Convenient. Easy to scrape. Easy to abuse for spam and social engineering.
Why businesses should care
Consumer chat apps show up in companies anyway. Shadow IT. Side channels. Incident bridges that started as “just use Discord.” When that happens, you inherit consumer threat models.
- Vendor and sub-processor risk you did not design.
- Malware culture that thrives in open invite spaces.
- Encryption stories that sound stronger than the default settings.
- Audit and retention rules that are hard to prove.
If chat is part of how you run production, treat it like production. Ask who can read messages. Ask who else gets a copy for support. Ask what a bot token can do. Ask what happens when an invite link goes stale and someone else claims it.
What to do with that
You do not need to ban every modern app tomorrow. You do need honest threat models. For casual social use, Discord and Telegram are common and people know them. For sensitive ops, legal, or regulated work, “everyone is already there” is not a security control.
That is one reason self-hosted or tightly controlled chat keeps coming back. See also IRC in 2026. Smaller surface. Clearer ownership. More ops work. Different trade.
Questions? Email admin@jvmlab.org.