Telus Customer Accounts Breached in Credential-Based Attacks

Telus is notifying consumer customers that attackers accessed their telecommunications accounts using compromised login credentials, exposing personal and billing-related information.

The intrusions occurred between February 2025 and June 2026, according to details contained in Telus breach notifications. The Canadian telecommunications provider has not disclosed how many accounts or individuals were affected.

This was not limited to passive data theft. Telus said the stolen information was later used to pressure customers into moving their telecommunications services to competing providers. Attackers also made unauthorized service changes on some accounts.

Compromised credentials opened customer accounts

The intruders authenticated with valid but compromised customer credentials. Telus has not established publicly where those usernames and passwords originated or whether they were stolen directly from its systems.

The activity is consistent with an account-takeover operation involving credential reuse. In such attacks, criminals test passwords exposed through unrelated breaches, phishing campaigns, malware infections or other credential-theft operations against additional services.

Credential stuffing is one possible explanation, but Telus has not confirmed that technique. It is also unknown whether the attackers bypassed any additional authentication controls or targeted accounts without multifactor authentication.

Once logged in, the intruders could view information linked to each affected subscriber. The unauthorized service modifications indicate that at least some compromised accounts also provided access to operational functions, not merely customer records.

No software vulnerability, CVE identifier or affected product version has been identified. The available evidence instead points to misuse of legitimate account credentials.

Personal, billing and subscription records were exposed

The compromised accounts may have revealed several categories of customer information:

• Names
• Telus account numbers
• Telephone numbers
• Billing addresses
• Email addresses
• Partial payment-card numbers
• Subscription details
• Payment history

This combination is particularly useful for social engineering. An attacker who knows a subscriber’s telephone number, address, current services and previous payments can sound credible when impersonating Telus, another provider or the customer.

Account numbers and subscription details could also help criminals answer basic verification questions or construct requests that appear consistent with a victim’s existing service. Payment history adds further context for fraudulent billing messages.

Telus has not reported exposure of complete payment-card numbers, card authentication codes or full payment credentials. There is also no confirmed report of direct financial theft arising from the incident.

The risk cannot be dismissed, however. Partial card details are often used as supporting information in phishing calls, where a criminal cites the visible digits to create the impression that they already have access to a legitimate billing record.

Stolen data was used to target subscribers

The attackers allegedly used information obtained from Telus accounts to persuade customers to transfer their services to unnamed competitors. The precise mechanism has not been disclosed.

It is therefore unclear whether the activity involved fraudulent account closures, telephone-number transfers, subscription migrations or other service changes. Telus has only confirmed that unauthorized modifications occurred in some cases.

The incident creates several overlapping threats for affected customers:

• Targeted phishing by email, telephone or text message
• Impersonation of Telus employees or competing providers
• Fraudulent changes to telecom subscriptions
• Further account hijacking using reused passwords
• Attempts to manipulate customer-support personnel
• False billing or account-verification requests

Attackers could exploit the stolen records in more than one interaction. For example, an initial call might use accurate subscription information to establish trust, followed by a request for a password, verification code or additional payment details.

The undisclosed victim count makes the overall severity difficult to measure. Telus has not provided a formal incident rating, attributed the consumer-account activity to a named group or reported a ransomware component.

Telus Digital breach remains a separate incident

The customer-account compromises follow a separate breach involving Telus Digital, a Telus subsidiary, which confirmed an intrusion in March.

The cybercrime group ShinyHunters claimed to have stolen approximately 1 petabyte of information from Telus Digital systems. That figure has not been independently validated, and the contents of the allegedly stolen material have not been established.

There is currently no confirmed connection between the Telus Digital breach and the attacks against consumer telecom accounts. No evidence has been disclosed showing that the same actor conducted both operations or that credentials used against customer accounts came from Telus Digital.

Treating the incidents as related without technical evidence would risk obscuring their different characteristics. The consumer case involves authenticated access to individual subscriber accounts, while the Telus Digital event was described as a large-scale data theft claim.

Telus reset credentials and increased monitoring

Telus said it reset the compromised credentials and introduced enhanced security monitoring for affected accounts. The company also notified the Vancouver Police Department.

Impacted customers have been offered complimentary identity-theft protection services. Details about the duration or precise coverage of that protection have not been disclosed.

Several central questions remain unanswered. Telus has not revealed the number of breached accounts, how the credentials were obtained or the exact changes attackers made after gaining access.

It is also unknown whether the company identified a common credential source, such as a previous third-party leak, or whether separate credential-theft methods were involved. Additional disclosure would help customers assess whether changing only their Telus password is sufficient.

Customers should verify service changes through trusted channels

Anyone receiving a Telus breach notice should change the affected password immediately. The replacement should be unique and not used for email, banking, social media or other telecommunications accounts.

If the old password was reused elsewhere, those accounts should also be updated. Securing the associated email account is especially important because email can often be used to reset telecom credentials.

Customers should review their account information, subscriptions, recent payments and service settings for unexplained changes. Any discrepancy should be reported by contacting Telus through a known telephone number, official application or manually entered website address.

Unexpected messages about migrations, discounts, account verification or billing problems should be treated cautiously. Customers should not provide passwords or one-time verification codes to an incoming caller, even if that person can recite accurate account information.

Where available, multifactor authentication should be enabled. Telus has not publicly detailed the authentication options applicable to every affected consumer service, so customers may need to verify which protections their specific accounts support.

Affected subscribers should also monitor payment-card statements and credit records, despite the absence of evidence that complete card credentials were exposed. The more immediate danger is highly personalized fraud built around legitimate Telus account data.