TELUS hit by data security incident after 18 months of unauthorised access

TELUS Corporation disclosed a data breach after threat actors accessed its network for nearly 18 months and stole confidential customer data.

 

Headquartered in Vancouver, British Columbia, TELUS is one of Canada’s largest telecommunications companies, offering mobile communications, home internet, voice, and television services to millions of customers nationwide.

In an email sent to affected customers, TELUS said that it recently detected a data security incident affecting several critical systems. The telecom giant immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“Some time between February 2025 and June 2026, unauthorised individuals used compromised credentials to access your TELUS account. These individuals may have used your account information to contact you in an attempt to persuade you to move your services away from TELUS towards competitors, and/or made unauthorised changes to your TELUS services,” the telecom provider said.

 

The compromised data included names, account numbers, billing addresses, preferred language, phone numbers, email addresses, last four digits of payment card details, service details, and the amounts charged and payment history for these services. 

 

TELUS is yet to share the number of affected accounts.

 

As a precautionary measure, TELUS terminated the compromised credentials to prevent further unauthorised access. The company also placed a note on the affected accounts documenting the incident, reported the matter to the Vancouver Police Department, and is cooperating with its investigation. 

 

In addition, TELUS implemented enhanced security monitoring on the affected accounts. Customers may therefore be required to answer additional verification questions when contacting TELUS to help protect their accounts from unauthorised access.

 

“TELUS has also retained NORTON to provide two (2) years of complimentary TELUS Guardian identity theft protection,” the telecom provider added.

 

In March, TELUS Digital, a subsidiary of TELUS Corporation, acknowledged a cybersecurity incident following claims by the ShinyHunters cybercrime group that it had exfiltrated nearly 1 petabyte of data from the company’s systems.