- Confidential and Proprietary - Luminar Annual Threat Landscape Report Page 23 and sales of breached data. Comparing the numbers of posts offering leaked records on Telegram and the Dark Web shows that starting in 2021, Telegram toppled the Dark Web platforms. Both in 2021 and 2022, the volume of messages sharing leaked records on Telegram is approximately double the number of posts on the Dark Web. Graph 5 – The number of shared leaked records in Telegram and the Dark Web While we can see the huge amount of data leaks shared on Telegram, it is important to remember that sometimes the numbers do not tell the whole story. Looking into the data itself, we can see that most of data leaks shared on Telegram are what is known as ‘Combolists,’ lists of emails and passwords that were scraped from various sources. In many cases such data is recycled, taken from previous leaks that were published on both Telegram and the Dark Web. However, unlike the ‘Combolists’ on Telegram, the data leaks shared on Dark Web sources are databases of specific websites or platforms that were hacked. Despite the large quantity of data leak messages on Telegram side, Dark Web sources, while amounting to fewer messages, still offer “better quality” data leaks and breached databases. The sale of network access has become increasingly popular in recent years and offers of access credentials appear on both Dark Web platforms and Telegram. As seen in Graph 6, between 2019- 2022, cybercriminals have preferred to use the Dark Web to post offers on access to networks. 0 5,000 10,000 15,000 20,000 25,000 30,000 35,000 40,000 45,000 50,000 2020 2021 2022 Telegram Dark Web