Between February 2025 and June 2026, Telus accounts were accessed by attackers using stolen credentials in a prolonged campaign. The attackers obtained sensitive subscriber information such as personal details and partial payment card data. This information was exploited to attempt service transfers and unauthorized account modifications. Telus responded by resetting compromised credentials and enhancing monitoring on impacted accounts. Law enforcement was informed, and victims were offered identity theft protection. The breach likely involved credential stuffing or account takeover, but the exact source of credentials remains unconfirmed. The incident follows a prior breach involving Telus Digital and the ShinyHunters group, though a direct connection is not explicitly stated.

The breach exposed personal and billing information of Telus subscribers, including sensitive data such as partial payment card numbers and payment history. Attackers used this data to attempt to persuade customers to switch services and to make unauthorized changes to accounts, potentially leading to financial and privacy harm. The exact number of affected accounts is unknown. The incident may increase risks of identity theft and fraud for impacted customers.

Telus has reset compromised credentials and implemented enhanced security monitoring on affected accounts. Customers impacted by the breach have been offered complimentary identity theft protection services. The Vancouver Police Department has been notified. No further immediate action is required from customers beyond following Telus guidance and monitoring their accounts. Organizations should remain vigilant for credential stuffing and account takeover attempts and consider multi-factor authentication where possible.