Telegram gave U.S. investigators the phone number, user ID and IP address of a Louisiana man accused of taking part in the Oct. 7 attack on Israel, according to court records that became public this week.
The records include a short letter from the company and are the first public look at what Telegram actually sends when it hands over user data, 404 Media reported on Thursday, in work done with the court-records outlet Court Watch. The letter names one account, lists the phone number tied to it and gives an IP address logged on Oct. 8, 2025, at 2:08.
“For this particular case, the following information was available,” the letter begins. It closes: “We hope this information will be helpful in your investigation. Kind regards, The Telegram Team.”
Telegram said in the letter that it was providing the information “voluntarily” and was “not conceding that we are subject to U.S. jurisdiction for this or any other request or any purpose.” A government filing in the same case tells it differently. It says the data came in response to a court order issued under the Stored Communications Act, the federal law that sets out how investigators can compel tech companies to turn over records.
The letter also gave what Telegram called its “non-public contact point” for U.S. law enforcement requests, an email address that now sits in public court records. That’s a problem. Hackers often pose as police, sometimes using hijacked government email accounts, to trick tech companies into handing over people’s data.
The man in the case is Mahmoud Amin Ya’qub Al-Muhtadi, a Gaza native who was living in Lafayette, La. He was arrested on Oct. 16, 2025, about a week after the time stamp on the IP address in Telegram’s letter, according to the Justice Department. Prosecutors in the Western District of Louisiana charged him with providing material support to a foreign terrorist organization and with visa fraud.
The department said Mr. Al-Muhtadi was an operative of the military wing of the Democratic Front for the Liberation of Palestine, a Gaza-based group that joined the Hamas-led assault. The complaint says he armed himself on the morning of Oct. 7, 2023, gathered others and crossed into Israel. Prosecutors also accuse him of lying on the visa application he filed in Cairo before entering the United States in September 2024. The department said the case grew out of information from the Israeli government and the work of its Joint Task Force October 7.
For most of its history, Telegram almost never gave data to governments. That changed after French authorities arrested its chief executive, Pavel Durov, in August 2024, partly over the company’s refusal to help with a child abuse investigation.
About a month after the arrest, Telegram rewrote its privacy policy to say it would give IP addresses and phone numbers to law enforcement in response to valid legal orders. Mr. Durov said at the time that the company had been sharing that information with authorities on request since 2018.
The numbers moved fast. From January through September 2024, Telegram fulfilled 14 U.S. requests covering 108 users. For the full year it fulfilled 900 requests affecting 2,253 users, 404 Media reported in January 2025, citing figures from the company’s transparency bot. Nearly all of them came in the last three months of the year.
The company now answers such requests routinely, as other big messaging apps and tech platforms do.