TELUS Customer Accounts Breached Using Compromised Credentials

TELUS notified an unspecified number of consumer customers that unauthorized actors accessed their telecom accounts using compromised credentials from February 2025 through June 2026. Exposed information included contact details, account and subscription data, billing and payment history, and partial payment-card information; some victims also experienced unauthorized service changes. TELUS said the attackers may have used the data to persuade customers to transfer service to competing providers.

TELUS reset the compromised credentials, deployed enhanced monitoring, notified affected customers, and offered identity-theft protection services. The company reported the incident to the Vancouver Police Department and the Privacy Commissioner of Canada; it has not disclosed the credential source or number of affected accounts. The exposure creates heightened risk of follow-on social engineering, vishing, SIM-swap, and port-out fraud, and is separate from the March 2026 ShinyHunters intrusion involving TELUS Digital.