A database with 40 million Telegram users info was posted on one of the darknet forums. The file with merged data takes approximately 900 megabytes. Telegram's Press Service confirmed the fact that the database exists, noting that such information is collected through the built-in contact import function during registration:

Such databases usually contain the corresponding "phone number — user ID in Telegram". They are collected through abuse of the built-in contact import feature when registering a user. Unfortunately, no service that allows users to communicate with contacts from their phone book can completely exclude such a search.

The Telegram's Press Service also informed that most of the merged accounts are no longer relevant, and the measures taken back in 2019 help not to shine your number:

However, an analysis of these databases shows that the additional measures we took at the end of summer 2019 in response to reports about the search of Hong Kong user numbers were effective. More than 84% of the data was collected before the middle of 2019. Most of the accounts in this database — at least 60% - contain outdated data. This may indicate that last year we were able to significantly reduce the scale and speed of this type of abuse.

In addition, after messages from Hong Kong, we added the "Who can add me to contacts by phone number" setting. This setting, although it makes it very difficult for ordinary users to use Telegram (they become "invisible" even to those who know their phone number), allows dissidents and protest activists to completely hide the connection between their account and their phone number.

Telegram added that almost 70% of the accounts in the database are users from Iran, and 30% from Russia.