BreachPublished 14 Sep 2026

Telus Warns Customers of Account Breaches

Source SecurityWeek

Description

Telus, a major Canadian telecom provider, experienced a multi-month account breach campaign from February 2025 to June 2026. Attackers used stolen credentials to access subscriber personal data and billing records, including names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. The compromised information was used to attempt to convince customers to switch services and, in some cases, to make unauthorized changes to accounts. Telus reset affected credentials and implemented enhanced security monitoring. The Vancouver Police Department was notified, and identity theft protection services were offered to victims. The breach appears linked to credential stuffing or account takeover using credentials possibly obtained from third parties, though this is not confirmed by Telus.

Impact

The breach exposed personal and billing information of Telus subscribers, including sensitive data such as partial payment card numbers and payment history. Attackers used this data to attempt to persuade customers to switch services and to make unauthorized changes to accounts, potentially leading to financial and privacy harm. The exact number of affected accounts is unknown. The incident may increase risks of identity theft and fraud for impacted customers.

Defensive guidance

Telus has reset compromised credentials and implemented enhanced security monitoring on affected accounts. Customers impacted by the breach have been offered complimentary identity theft protection services. The Vancouver Police Department has been notified. No further immediate action is required from customers beyond following Telus guidance and monitoring their accounts. Organizations should remain vigilant for credential stuffing and account takeover attempts and consider multi-factor authentication where possible.

Summary

Between February 2025 and June 2026, Telus accounts were accessed by attackers using stolen credentials in a prolonged campaign. The attackers obtained sensitive subscriber information such as personal details and partial payment card data. This information was exploited to attempt service transfers and unauthorized account modifications. Telus responded by resetting compromised credentials and enhancing monitoring on impacted accounts. Law enforcement was informed, and victims were offered identity theft protection. The breach likely involved credential stuffing or account takeover, but the exact source of credentials remains unconfirmed. The incident follows a prior breach involving Telus Digital and the ShinyHunters group, though a direct connection is not explicitly stated.

References

securityweek.com/telus-warns-customers-of-account-breaches/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Sep 2026, 10:01 UTC

References

Community reviews