Incident
Published 2026-09-11
Updated 2026-10-25
Verified 2026-10-25

Telus warns some customers that attackers used compromised credentials to access their accounts between February 2025 and June 2026

Daily Hive (11 September 2026) reports that Telus confirmed unauthorised access to some customers' personal information.

A Telus spokesperson told Daily Hive: "We recently identified and blocked unauthorized access to limited information contained in a small number of telecom consumer accounts," without saying how many accounts were affected.

According to an email Telus sent customers, unauthorised individuals used compromised credentials to access customer accounts sometime between February 2025 and June 2026, and may have used the account information to contact customers to persuade them to move their services to competitors and/or made unauthorised changes to their Telus services. The compromised information included full name, account number, billing address, preferred language and phone numbers, and in most cases email address, the last four digits of the payment card on file, the types of service, amounts charged and payment history.

Telus says it notified affected customers, provided complimentary identity protection (two years of Telus Guardian through Norton; enrol by 30 November 2026) and contacted law enforcement and the Privacy Commissioner of Canada.

Telus has not said where the credentials came from. Distinct from the data theft Telus confirmed in March 2026. Primary: Daily Hive.

Correction (25 Oct 2026): the card date has moved from 14 to 11 September 2026, the date of Daily Hive's report (11:16 pm Perth time), and the card now rests on that report; a reference to Vancouver Police, which Daily Hive does not mention, has been removed. (source: Daily Hive)

Product
Telus consumer telecom accounts (Canada)
Versions
n/a (credential-based account takeover; not a product CVE)
Exploited in Australia?
unknown
Patch to
n/a for other operators: force password resets on suspected ATO, monitor SIM/port and plan-change abuse, offer identity monitoring where appropriate

breaches identity