Loading story…
TELUS notified an unspecified number of consumer customers that unauthorized actors accessed their telecom accounts using compromised credentials from February 2025 through June 2026. Exposed information included contact details, account and subscription data, billing and payment history, and partial payment-card information; some victims also experienced unauthorized service changes. TELUS said the attackers may have used the data to persuade customers to transfer service to competing providers.
TELUS reset the compromised credentials, deployed enhanced monitoring, notified affected customers, and offered identity-theft protection services. The company reported the incident to the Vancouver Police Department and the Privacy Commissioner of Canada; it has not disclosed the credential source or number of affected accounts. The exposure creates heightened risk of follow-on social engineering, vishing, SIM-swap, and port-out fraud, and is separate from the March 2026 ShinyHunters intrusion involving TELUS Digital.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
TELUS notified affected consumer customers that compromised credentials had been used to access their accounts and that some victims experienced unauthorized service changes. TELUS terminated affected credentials, added enhanced monitoring, offered identity-theft protection, and reported the incident to the Vancouver Police Department and the Privacy Commissioner of Canada.
TELUS Digital confirmed a separate breach after ShinyHunters claimed to have stolen approximately 1 petabyte of data from its systems. The incident reportedly involved Google Cloud Platform credentials exposed through the Salesloft Drift compromise and an alleged $65 million extortion demand that TELUS did not pay.
Unauthorized individuals used compromised credentials to access a small, undisclosed number of TELUS consumer telecom accounts. The access activity continued through June 2026 and exposed personal, account, billing, service, payment-history, and partial payment-card information.
TELUS-owned Koodo Mobile issued a breach notification involving compromised credentials and unauthorized access to customer data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Telus Digital** confirmed it is investigating a cybersecurity incident involving **unauthorized access to a limited number of systems** after threat actors **ShinyHunters** claimed a **multi-month intrusion** and the theft of **nearly 1 petabyte of data**. Reporting indicates the alleged stolen data includes information tied to Telus’ BPO operations (which can include customer support, billing, and internal tooling for multiple client organizations) and **call records** associated with Telus’ consumer telecommunications business; Telus stated operations remain fully functional and said it has engaged external forensics support and law enforcement while it determines what data was taken and which customers were affected. Additional details attributed to ShinyHunters claim the initial access path involved **Google Cloud Platform (GCP) credentials** that were allegedly found in data previously stolen during the **Salesloft/Drift breach**, suggesting credential reuse/exposure as a key risk factor. As of the reporting cited, Telus Digital had not yet appeared on the actor’s leak site, and the company had not publicly confirmed the attacker’s identity or the specific data types impacted beyond acknowledging the incident and ongoing investigation.
Jun 29, 2026
British telecommunications company Brsk confirmed unauthorized access to one of its customer database systems, resulting in the exposure of over 230,000 customer records. The stolen data, which was advertised for sale on a cybercrime forum, included full names, email and home addresses, installation details, location data, phone numbers, and indicators of vulnerability status. Brsk stated that no financial information, passwords, or account credentials were compromised, and there is no evidence of misuse so far. The company has notified affected customers, offered them 12 months of free monitoring services, and reported the incident to relevant authorities, including the ICO and police. Separately, Comcast agreed to pay a $1.5 million fine to settle an FCC investigation into a February 2024 vendor data breach that exposed the personal and financial information of nearly 275,000 customers. The breach occurred at Financial Business and Consumer Solutions (FBCS), a former debt collection vendor, and included names, addresses, Social Security numbers, dates of birth, and account numbers. Comcast has committed to enhanced vendor oversight, regular risk assessments, and improved compliance reporting as part of the settlement. Both incidents highlight the ongoing risks to customer data in the telecommunications sector, whether from direct attacks or third-party vendor breaches.
Jun 29, 2026
T-Mobile disclosed a major cyberattack that exposed personal information tied to more than 40 million current, former, and prospective customers, including names, dates of birth, Social Security numbers, and driver's license details. The company said the intrusion targeted customer records and prompted an ongoing investigation, while reporting indicated the breach affected both existing subscribers and people who had previously applied for credit with the carrier. The carrier was hit again in later incidents, underscoring persistent security problems despite a reported **$150 million** investment in cybersecurity. In early 2023, T-Mobile disclosed another breach affecting customer account data, and later that year a separate exposure involving roughly **90GB** of data surfaced on a hacker forum and was linked to a T-Mobile glitch, raising fresh concerns about the company's ability to prevent repeated leaks of sensitive customer information.
Jun 29, 2026