A database containing personal information about Lebanese would be offered for only $20 on Telegram. According to the information gathered by Al-Mahatta, the head of a network specializing in the search for license plates has allegedly offered certain subscribers access to data attributed to the « Nâfe The information available would help to find the owner’s full name, telephone number, village of origin and place of residence.
The case is not only a new breach of privacy. It recalls several precedents in Lebanon, including a surprisingly similar case dating back to 2010: an application marketed for about $7 already allowed to search for personal information from a license plate or telephone number. Sixteen years later, the reappearance of this type of service raises a question that remains unanswered: how do databases held by administrations or fed by official data continue to circulate out of control?
For 20 dollars, data from the Nafe
« Nâfe的a » commonly refers to the authorities responsible for vehicle registration and driving licence formalities. These administrations necessarily have information to associate a plate with its owner. The problem arises when these data leave the system for which they were collected and become accessible to persons who have no administrative or judicial reason to consult them.
A license plate remains visible in the public space, but it does not normally reveal the telephone number or the owner’s domicile. A basis for linking these elements therefore turns visible information into a real identification tool. Anyone with the file could, in theory, from a vehicle seen in the street to go back to its owner and get more information about it.
The announced price makes this situation even more worrying. At $20, access to such information would no longer be restricted to actors with significant technical capabilities. A digital database can also be copied, transferred and sold almost without limit. Close a Telegram channel would therefore not recover already downloaded files.
An almost identical precedent in 2010
The current case has a striking resemblance to an episode that occurred in November 2010. At the time, a database containing information about Lebanese was available through Internet-based applications for approximately $7. One was able to search from a mobile phone number and another from a license plate.
The Lebanese press had then revealed that the system allowed private information to be found, including the identity and residence of wanted persons. The Ministry of the Interior, the Ministry of Telecommunications, the two mobile telephone operators and the banks had denied responsibility for data transmission. An investigation was announced to determine their provenance.
This precedent is essential for understanding the current case. The problem of 2026 therefore lies not only in the appearance of a new tool on Telegram. Data on Lebanese vehicles and telephones were already circulating commercially more than 15 years ago. The switch from a few dollars to a Telegram channel shows above all that the means of broadcasting have changed, while the question of the origin of the files remains.
Who feeds the bases in circulation?
It is still impossible, in the state of the information available, to state that the currently proposed base comes directly from a recent intrusion into Nâfe’a systems. It may be an internal extraction, an old copy, compromised identifiers, a file held by a provider or information from several different bases and then grouped together.
The age of the data is therefore a determining factor. A database copied several years ago may still contain sensitive information, even though some phones or homes have changed. The presence of recent information would have a much more serious significance: it could indicate that an individual or group continues to have access to up-to-date data.
A survey should compare the proposed information with the official files and determine their date. It should also examine accounts with significant access rights and seek possible massive extractions. Without this technical investigation, designating the leaker or his original administration would be speculative.
In 2022, the platform of the Ministry of Health hacked
The circulation of car data is not the only recent precedent. In February 2022, the Lebanese Ministry of Health had officially acknowledged an intrusion on its MOPH PASS platform, used in particular for travellers arriving in Lebanon during the Covid-19 pandemic. The flaw had led to the exposure of personal data stored on the platform.
The case took on a political dimension when personal information concerning the Minister of Public Works and Transport, Ali Hamiyé, was disclosed. The then Minister of Interior, Bassam Mawlawi, had then instructed the General Security to investigate. The Ministry of Health then announced that it had identified and corrected the vulnerability, noting that the incident had affected a limited number of data concerning public figures.
This precedent shows that an official Lebanese platform containing personal information has already been compromised. It also recalls the diversity of files held by the State: health, travel, civil status, telecommunications, vehicles or electoral lists are all sets that, when crossed, can provide a particularly detailed picture of a person.
Voter lists containing much information
Another example of the amount of administrative data available in Lebanon is the electoral roll. They legally contain a number of information that makes it possible to identify voters precisely: name, names of parents, date of birth, sex, confession and register number. Their existence and communication meet the needs of the electoral process, but their wealth shows the amount of personal information centralized in public files.
Risk increases when data from multiple sources are pooled. A plaque may lead to a name, an election file at a date of birth and a place of registration, while another file may provide a telephone or address. The challenge of data protection is therefore no longer simply to secure each database separately, but to prevent its clandestine aggregation.
However, Lebanon has a legal framework. Law No 81 of 10 October 2018 regulates the processing of personal data, including rules on their collection, use and communication. It also provides for sanctions in certain situations of disclosure to unauthorized persons.
When data can help locate a target
In the Lebanese context, however, the flow of such information exceeds the protection of privacy alone. Administrative data hacked, obtained clandestinely or transmitted by agents may be used with other information to identify an individual, establish relationships or help determine his or her location.
This risk took on a particularly concrete dimension during the war between Israel and Hezbollah. Intelligence operations are not based on a single source. They typically combine human intelligence, interception, aerial surveillance, telecommunications, digital data and travel observation. In this device, an administrative basis may provide an additional piece of evidence to confirm an identity or to associate a vehicle with a wanted person.
Retired Lebanese General Mounir Chehadeh, former Government coordinator to UNIFIL, stated in 2026 that Israel had had access to a significant portion of Lebanese data infrastructure for years. He referred in particular to information on mobile telephone subscribers and vehicle registrations. According to him, these capabilities, combined with other intelligence sources, have contributed to the establishment of target banks.
These statements do not prove that the basis proposed today on Telegram has been used by Israel, nor that a particular administrative basis has directly enabled a definite elimination. However, they show why an automobile data leak may pose a safe risk. A plaque associated with a name, phone and address has a very different value when it is crossed with location or surveillance information.
From the Hariri case to billions of telephone data
The power of the data crossing had already been highlighted after the assassination of Rafic Hariri on 14 February 2005 in Beirut. International investigators had used considerable amounts of telecommunications data to rebuild telephone networks, seek user connections and study communications surrounding the attack.
As early as 2005, the United Nations International Commission reported that it had established a base comprising more than 97 million telecommunication records for a period surrounding the assassination. Investigations then covered billions of records. The extent of the data transmitted to investigators, their use and reliability, had led to significant political and judicial controversy in Lebanon.
The context was obviously different: this information was used in an international investigation and not illegally marketed. But the case had already shown that a mass of metadata can rebuild networks and behaviors that remain invisible when each information is considered separately.
A leak of unknown magnitude
The priority now is to determine what the proposed base actually contains for $20. A few successful searches from plates are not sufficient to establish that the entire national registration file has been copied. It is necessary to know the number of records, their seniority, the frequency of their updating and the source of the various fields available.
Above all, it is important to know whether the seller has a simple copy or has access to up-to-date information. The second hypothesis would mean that a breach remains potentially open. The 2010 precedent shows that the trade in Lebanese car data is not a new phenomenon; The MOPH PASS case confirms that public systems have already been compromised.
Sixteen years after the sale of an app to explore the privacy of Lebanese people for about $7, a comparable basis would be proposed for $20 on Telegram. Between the two cases, technologies have changed and Lebanon has a law on personal data. The essential question remains: who extracts this information from the systems that hold it, and who now controls the copies already in circulation?
