From leaked question papers to piracy and CSAM – why is Telegram always in trouble in one country or another?

The instant messaging and social media app Telegram found itself entangled in the NEET UG question paper leak scandal in India and has been temporarily banned in the country until 22 June. Telegram was banned at the request of the National Testing Agency (NTA) under Section 69A of the IT Act to prevent cheating, exam-related fraud and the spread of fake paper leaks ahead of the NEET-UG 2026 medical entrance re-examination scheduled for 21 June.

Telegram ban in India

The Ministry of Electronics and Information Technology (MeitY) has also directed Google Play Store and Apple App Store to restrict downloads of Telegram in India till 22 June. MeitY also ordered Telegram to disable its message-editing feature for already-posted content within India until 30 June.

According to the NTA, scamsters were using Telegram to operate channels that targeted students and parents, promising leaked NEET re-exam question papers in exchange for thousands to lakhs of rupees. NTA also alleges that the fraudsters were misusing Telegram’s edit message feature to give the impression that the question paper had been leaked.

Telegram ban in other countries

While this is the first time Telegram has faced such a restriction in India, the platform launched by Russia-born Pavel Durov in August 2013 has faced bans or other punitive measures in several countries in the past.

The ban was imposed in countries, including China, Iran, North Korea, Nepal, Kenya, Brazil, Spain, Thailand and Russia. While some of these restrictions were temporary and linked to unrest there, Telegram remains banned and under investigation in several other countries worldwide for its links to illegal activities.

Pavel Durov’s arrest in France

The most notable such case was in August 2024, when Durov, a resident of the UAE who also holds French citizenship, was arrested at the Le Bourget Airport in Paris. French authorities alleged that his messaging app, Telegram, was being used as a tool for illicit activities, including drug trafficking, organized crime, fraud and the distribution of Child Sexual Abuse Material (CSAM).

French authorities formally charged Durov on 12 counts, including complicity in organized crime transactions, money laundering and failing to cooperate with authorized legal interceptions.

According to French prosecutors, Telegram lacked sufficient moderation, and unscrupulous elements exploited its strict privacy and encryption features to commit criminal acts.

Telegram, a hub of piracy

A recent study published by Cornell University revealed that Telegram has emerged as a major platform for large-scale video piracy, where copyrighted content is rapidly distributed among users.

The study looked at 1,057 channels that shared 209k unique posts between December 2023 and January 2026. It found that the channels collectively distributed 19,033 unique copyrighted titles originating from 175 countries, accumulating over 4.85B unique views and resulting in a lower-bound estimated financial loss of $17.49B for content rights holders.

What makes Telegram attractive to cybercriminals?

According to Ampcus Cyber, several Telegram features have made it a favourite for cybercriminals. These include:

Anonymity: Signing up requires just a temporary or virtual number and usernames can be anything; no real identity is required.

Weak moderation: Even when illegal channels are taken down, they usually pop right back up under new names.

Cloud storage: Files, tools and stolen data can be easily shared and searched, creating an archive of cybercrime resources.

Mass reach: Telegram channels can have unlimited followers, making it easy to instantly broadcast services or stolen data to thousands.

Cybercheck Security adds rapid content sharing and the easy creation of illegal marketplaces as other reasons why Telegram is attractive to criminals.

“New channels pop up constantly, and it’s imperative that we’re on top of their arrivals,” Cybercheck senior analyst Stuart Holder said in a blog post.

“The larger channels are data-rich and contain a lot of information, so some monitoring services just focus on those. However, at Cybercheck, we spread our work over thousands of channels to ensure we’re receiving credentials from every angle. This gives us our competitive edge. It means we can provide rapid, comprehensive alerting to help organizations stop threats before they spread and prevent attacks before they happen,” he adds.