Two privacy stories broke within days of each other in May 2026, and read together they make one quiet point: the data that can hurt you later is the data that gets stored . First, a dataset claiming to hold details of more than 200 million Telegram accounts — usernames, email addresses, phone numbers, and in some cases partial password data — surfaced on a dark-web forum. Around the same time, researchers documented how Telegram's network layer can leak persistent identifiers that let network operators correlate users without ever breaking the encryption itself. Then TechCrunch reported a new phishing wave aimed at Signal users : attackers trying to trick people into handing over the recovery key that unlocks their cloud message backups — which can hold years of old chats, photos, and documents. The common thread: accounts and history are the attack surface Look at what both attacks actually go after. Not the live end-to-end encryption — that mostly held up.…