TELUS Warns Customers of 16-Month Account Takeover Breach via Compromised Credentials

Key facts for TELUS credential compromise breach

Detection coverage for TELUS credential compromise breach

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2491 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Credential-Stuffing / Account-Takeover Login Pattern Against My TELUS Consumer Portal

Detects the classic credential-stuffing signature reported in the TELUS consumer account-takeover disclosure: a burst of failed authentications against the My TELUS self-serve login endpoint from a small set of source IPs/ASNs, followed by one or more successful logins on distinct customer accounts using previously-compromised (third-party-sourced) passwords, with no corresponding password-reset or MFA-challenge event. Matters because this is the sole documented entry vector for the 16-month unauthorized access window (Feb 2025-Jun 2026).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110.004, T1589.001, T1078
• Data sources: ciam_authentication_logs, web_proxy_access_logs, waf_logs
• Severity: high
• Confidence: high

Splunk SPL

index=ciam OR index=web_proxy sourcetype="myTELUS:authentication"
| eval outcome=coalesce(auth_result, status)
| bin _time span=10m
| stats count(eval(outcome="failure")) AS fail_count, dc(user) AS distinct_users_targeted, values(user) AS users_targeted, count(eval(outcome="success")) AS success_count, values(src_ip) AS src_ips by src_ip, _time
| where fail_count>=15 AND distinct_users_targeted>=10 AND success_count>=1
| eval mfa_seen=if(searchmatch("mfa_challenge=true"), "yes", "no")
| where mfa_seen="no"
| table _time, src_ip, fail_count, distinct_users_targeted, success_count, users_targeted
| sort -fail_count

Microsoft KQL

let ThresholdWindow = 10m;
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where AppDisplayName has "My TELUS" or AppDisplayName has "myTELUS-Portal"
| summarize FailCount = countif(ResultType != "0"), SuccessCount = countif(ResultType == "0"), DistinctUsersTargeted = dcount(UserPrincipalName), UsersTargeted = make_set(UserPrincipalName, 25) by IPAddress, bin(TimeGenerated, ThresholdWindow)
| where FailCount >= 15 and DistinctUsersTargeted >= 10 and SuccessCount >= 1
| project TimeGenerated, IPAddress, FailCount, SuccessCount, DistinctUsersTargeted, UsersTargeted
| order by FailCount desc

Sigma

title: Credential Stuffing Against Consumer Telecom Self-Serve Portal Login
id: 6f2a1e0c-3d4b-4a7e-9c1f-2b8e5f6a1d70
status: experimental
description: Detects a high-volume mixed failure/success authentication burst from a single source against a consumer telecom self-serve account portal, consistent with credential-stuffing account takeover using passwords compromised from a third-party breach corpus.
references:
  - https://www.securityweek.com/telus-warns-customers-of-account-breaches/
  - https://attack.mitre.org/techniques/T1110/004/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
  - attack.credential-access
  - attack.t1110.004
  - attack.reconnaissance
  - attack.t1589.001
  - attack.initial-access
  - attack.t1078
logsource:
  category: authentication
  product: web
detection:
  selection_fail:
    outcome: failure
  selection_success:
    outcome: success
  timeframe: 10m
  condition: selection_fail | count(user) by src_ip >= 15 and selection_success | count() by src_ip >= 1
falsepositives:
  - Misconfigured mobile app retrying stale cached credentials at scale
  - Corporate NAT/proxy egress IP shared by many legitimate customers with unrelated forgotten passwords
level: high

Known false positives:

• Shared corporate/carrier-grade NAT egress IP generating incidental failed logins from unrelated customers
• Mobile app update causing mass token-refresh failures that resemble a failure burst

Tuning notes: Tune fail_count/distinct_users_targeted thresholds to the portal's real traffic baseline; exclude known corporate NAT egress ranges via an allowlist lookup; correlate with breached-password-screening service hits to raise confidence before alerting on-call.

• 🔒 Credential-Stuffing Burst Against Consumer Portal Sign-In (Sentinel) · unlock with TL Creds
• 🔒 New-Context Session Rapidly Enumerating Billing, Payment-History and Subscription Data (Sentinel) · unlock with TL Creds
• 🔒 Unverified Plan Change / Port-Out Shortly After Risky Sign-In (Sentinel) · unlock with TL Creds
• 🔒 Sigma: Credential Stuffing Burst Against Consumer Self-Serve Portal · unlock with TL Creds
• 🔒 Sigma: New-Context Session Enumerating Billing, Payment-History and Subscription Data · unlock with TL Creds
• 🔒 Sigma: Unverified Service/Plan Change or Port-Out Following Risky Login · unlock with TL Creds
• 🔒 Anomalous Post-Login Bulk Access to Billing, Payment-History and Subscription Data via My TELUS Dashboard · unlock with TL Creds
• 🔒 Unauthorized Post-Takeover Plan Change / Port-Out Request Consistent with Carrier-Switch Impersonation Fraud · unlock with TL Creds

Indicators of compromise for TELUS credential compromise breach

As of 2026-09-14, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-2491.

How TELUS credential compromise breach works

Attackers used the access to impersonate TELUS representatives (by phone and in door-to-door sales contact) and pressure some customers into switching to a competing carrier, and in some cases made unauthorized changes to victims' services.

TELUS Communications disclosed to affected consumer customers on or around September 11, 2026 that it had "identified and blocked unauthorized access to limited information contained in a small number of telecom consumer accounts." CTV News, reporting the same day, characterized the disclosure as TELUS describing a "data security incident" in which customer accounts were accessed. The unauthorized access reportedly spanned February 2025 through June 2026 -- a roughly 16-month window -- and was carried out using compromised account credentials rather than any confirmed exploitation of a TELUS system vulnerability. Multiple outlets characterize the activity as consistent with credential stuffing or another account-takeover technique using previously compromised logins, though TELUS has not confirmed the third-party origin of the passwords used, nor disclosed how many accounts were affected.

Exposed data varied by account but included the customer's full name, account number, billing address, preferred language, phone number(s), email address (in most cases), the last four digits of the payment card on file, subscribed service type(s), and billing/payment history. No full payment card numbers, passwords, or government ID numbers have been reported as exposed.

Beyond simple data viewing, the notification describes affirmative fraud activity consistent with attackers using the My TELUS consumer self-serve account dashboard to review billing, subscription, and payment-history data on each compromised account, then acting on it: unauthorized parties contacted some customers by phone while impersonating TELUS representatives, and secondary reporting (SSBCrack News) additionally describes impersonation attempts via door-to-door sales-representative contact, both aimed at persuading customers to switch their service to a competing provider. In other cases attackers made unauthorized changes directly to the victim's TELUS services. This pattern is consistent with telecom account-takeover fraud schemes in which attackers monetize sustained access to subscriber/billing records rather than deploying malware -- the persistence of unauthorized access across a 16-month window, using only legitimate stolen credentials and the standard customer portal, is itself notable as a defense-evasion pattern (no exploit, malware, or anomalous infrastructure needed to remain undetected).

TELUS says it has reset credentials on the affected accounts, added enhanced security monitoring, notified the Vancouver Police Department and the Office of the Privacy Commissioner of Canada, and is offering affected customers two years of complimentary identity-theft protection via "TELUS Guardian," a Norton-powered service that includes dark-web monitoring, one-bureau credit monitoring, an annual credit report/score, identity restoration support, up to CAD/USD $25,000 in reimbursement for stolen funds and related personal expenses, and up to $1 million in identity-theft-related legal/expert-fee coverage, plus a 90-day complimentary Norton Security Deluxe subscription. Enrollment is open through November 30, 2026.

This incident is distinct from the March 2026 breach at TELUS Digital (TELUS's international CX/BPO subsidiary), in which the extortion group ShinyHunters claimed to have stolen approximately 1 petabyte (roughly 1,000 TB) of data and demanded a $65 million ransom. No source reviewed ties this consumer account-takeover campaign to ShinyHunters or to the TELUS Digital intrusion technically or by attribution; the two are tracked here only as related, contemporaneous incidents affecting the same corporate parent.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Persistence

T1078 Valid Accounts

Defense Evasion

T1078 Valid Accounts

Credential Access

T1110.004 Brute Force: Credential Stuffing

Collection

T1213 Data from Information Repositories

Discovery

T1538 Cloud Service Dashboard

Impact

T1565.001 Data Manipulation: Stored Data Manipulation; T1657 Financial Theft

Reconnaissance

T1589.001 Gather Victim Identity Information: Credentials

stealth

T1684.001 Impersonation

Remediation for TELUS credential compromise breach

Immediate actions

• Force a credential reset on every affected TELUS consumer account and require re-authentication (TELUS has already done this for known-affected accounts)
• Enforce multi-factor authentication (MFA) on the My TELUS customer self-serve portal and account-servicing call-center workflows
• Apply enhanced fraud/anomaly monitoring to accounts that show login activity from unfamiliar devices, locations, or velocities during Feb 2025-Jun 2026

Workarounds

• Affected customers should enroll in the complimentary Norton-powered TELUS Guardian identity-theft protection before the November 30, 2026 deadline
• Customers should independently verify any unsolicited call, door-to-door visit, or offer to switch carriers or modify service by contacting TELUS directly through official channels rather than the contacting party
• Customers should monitor billing statements and account activity for unrecognized service or plan changes

Longer-term hardening

• Deploy credential-stuffing / bot-mitigation controls (rate limiting, device fingerprinting, CAPTCHA, IP reputation) in front of consumer account authentication endpoints
• Screen submitted passwords against known breached-credential corpora at signup and login (breached-password screening)
• Add out-of-band verification (e.g., callback to a known-good number, in-app confirmation) before processing carrier-switch/porting or service-plan change requests initiated after a customer contact
• Train and audit frontline channel partners -- call-center agents and door-to-door retail/sales representatives -- to verify account ownership through an out-of-band channel before honoring inbound requests to switch service or modify a plan, since attackers impersonated TELUS through both channels

Affected and fixed versions

• TELUS Communications Inc. — My TELUS consumer self-serve account portal / TELUS consumer telecom accounts
  Vulnerable versions: Consumer accounts active between February 2025 and June 2026
  Fixed in: Credentials reset and enhanced monitoring applied to affected accounts as of the September 2026 disclosure

Timeline of TELUS credential compromise breach

• 2025-02-01 TELUS reports unauthorized access to consumer accounts began in February 2025, using compromised login credentials.
• 2026-03-01 locked-ioc-8 (a distinct TELUS subsidiary) suffers a separate breach claimed by extortion group ShinyHunters, who allege theft of ~1PB of data and demand a $65M ransom; no confirmed link to this consumer account-takeover campaign.
• 2026-06-01 The unauthorized access window to affected TELUS consumer accounts ends/is detected around June 2026.
• 2026-09-11 CTV News reports on the disclosure, characterizing it as TELUS describing accounts accessed in a 'data security incident.'
• 2026-09-11 TELUS begins notifying affected customers and confirms the breach publicly; MobileSyrup reports the disclosure.
• 2026-09-14 SSBCrack News reports that, alongside phone-based impersonation, attackers used compromised account data to attempt impersonation of TELUS through door-to-door sales-representative contact.
• 2026-09-14 SecurityWeek and other outlets publish coverage of TELUS's customer breach notification.
• 2026-11-30 Deadline for affected customers to enroll in the complimentary two-year Norton-powered TELUS Guardian identity-theft protection offer.

Sources cited for TELUS credential compromise breach

• Telus Warns Customers of Account Breaches - Live Threat Intelligence radar.offseq.com · Research · 2026-09-14
• Telus: Telus confirms some customers' personal information exposed in data breach blog.rankiteo.com · Blog · 2026-09-14
• Inside the Telus Digital Breach: How ShinyHunters Stole Nearly 1 Petabyte Through a Single Credential (related, distinct incident) breached.company · Blog · 2026-03-01
• Telus Warns Customers of Account Breaches SecurityWeek · News · 2026-09-14
• Telus confirms some customers' personal information exposed in data breach mobilesyrup.com · News · 2026-09-11
• Telus Warns Customers After Extended Account Breach cloudlinktech.com · News · 2026-09-14
• Telus Warns Customers of Account Breaches (syndicated) itsecuritynews.info · News · 2026-09-14
• Telus accounts accessed in 'data security incident,' company says ctvnews.ca · News · 2026-09-11
• Telus Customers Warned After Unauthorized Access to Personal Information news.ssbcrack.com · News · 2026-09-14

More in data breach

• WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data
• Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals
• Wagyu.xyz Alleged Data Leak: 38,628 Swap Orders and 10,139 IPs Claimed by WhiteArmor, Exposing Monero Metadata Correlation Risk