# TELUS Warns Customers of 16-Month Account Takeover Breach via Compromised Credentials

> TELUS notified Canadian consumer customers that unauthorized parties used compromised login credentials to access a small number of telecom accounts between February 2025 and June 2026, exposing names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. Attackers used the access to impersonate TELUS representatives (by phone and in door-to-door sales contact) and pressure some customers into switching to a competing carrier, and in some cases made unauthorized changes to victims' services.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2491
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-telus-credential-compromise-breach-tl-2026-2491.webp?v=42295436 (Threadlinqs threat intel: TELUS 16-Month Credential Breach: Detection & IOCs (TL-2026-2491) — Medium severity, 8 IOCs, 9 detection rules.)
- **ID:** TL-2026-2491
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

TELUS Communications disclosed to affected consumer customers on or around September 11, 2026 that it had "identified and blocked unauthorized access to limited information contained in a small number of telecom consumer accounts." CTV News, reporting the same day, characterized the disclosure as TELUS describing a "data security incident" in which customer accounts were accessed. The unauthorized access reportedly spanned February 2025 through June 2026 -- a roughly 16-month window -- and was carried out using compromised account credentials rather than any confirmed exploitation of a TELUS system vulnerability. Multiple outlets characterize the activity as consistent with credential stuffing or another account-takeover technique using previously compromised logins, though TELUS has not confirmed the third-party origin of the passwords used, nor disclosed how many accounts were affected.

Exposed data varied by account but included the customer's full name, account number, billing address, preferred language, phone number(s), email address (in most cases), the last four digits of the payment card on file, subscribed service type(s), and billing/payment history. No full payment card numbers, passwords, or government ID numbers have been reported as exposed.

Beyond simple data viewing, the notification describes affirmative fraud activity consistent with attackers using the My TELUS consumer self-serve account dashboard to review billing, subscription, and payment-history data on each compromised account, then acting on it: unauthorized parties contacted some customers by phone while impersonating TELUS representatives, and secondary reporting (SSBCrack News) additionally describes impersonation attempts via door-to-door sales-representative contact, both aimed at persuading customers to switch their service to a competing provider. In other cases attackers made unauthorized changes directly to the victim's TELUS services. This pattern is consistent with telecom account-takeover fraud schemes in which attackers monetize sustained access to subscriber/billing records rather than deploying malware -- the persistence of unauthorized access across a 16-month window, using only legitimate stolen credentials and the standard customer portal, is itself notable as a defense-evasion pattern (no exploit, malware, or anomalous infrastructure needed to remain undetected).

TELUS says it has reset credentials on the affected accounts, added enhanced security monitoring, notified the Vancouver Police Department and the Office of the Privacy Commissioner of Canada, and is offering affected customers two years of complimentary identity-theft protection via "TELUS Guardian," a Norton-powered service that includes dark-web monitoring, one-bureau credit monitoring, an annual credit report/score, identity restoration support, up to CAD/USD $25,000 in reimbursement for stolen funds and related personal expenses, and up to $1 million in identity-theft-related legal/expert-fee coverage, plus a 90-day complimentary Norton Security Deluxe subscription. Enrollment is open through November 30, 2026.

This incident is distinct from the March 2026 breach at TELUS Digital (TELUS's international CX/BPO subsidiary), in which the extortion group ShinyHunters claimed to have stolen approximately 1 petabyte (roughly 1,000 TB) of data and demanded a $65 million ransom. No source reviewed ties this consumer account-takeover campaign to ShinyHunters or to the TELUS Digital intrusion technically or by attribution; the two are tracked here only as related, contemporaneous incidents affecting the same corporate parent.

## MITRE ATT&CK

- T1589.001 Gather Victim Identity Information: Credentials
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1110.004 Brute Force: Credential Stuffing
- T1538 Cloud Service Dashboard
- T1213 Data from Information Repositories
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1684.001 Impersonation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Credential-Stuffing / Account-Takeover Login Pattern Against My TELUS Consumer Portal** (`TL-2026-2491-SPL-001`)

Detects the classic credential-stuffing signature reported in the TELUS consumer account-takeover disclosure: a burst of failed authentications against the My TELUS self-serve login endpoint from a small set of source IPs/ASNs, followed by one or more successful logins on distinct customer accounts using previously-compromised (third-party-sourced) passwords, with no corresponding password-reset or MFA-challenge event. Matters because this is the sole documented entry vector for the 16-month unauthorized access window (Feb 2025-Jun 2026).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1110.004, T1589.001, T1078
- **Data sources:** ciam_authentication_logs, web_proxy_access_logs, waf_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=ciam OR index=web_proxy sourcetype="myTELUS:authentication"
| eval outcome=coalesce(auth_result, status)
| bin _time span=10m
| stats count(eval(outcome="failure")) AS fail_count, dc(user) AS distinct_users_targeted, values(user) AS users_targeted, count(eval(outcome="success")) AS success_count, values(src_ip) AS src_ips by src_ip, _time
| where fail_count>=15 AND distinct_users_targeted>=10 AND success_count>=1
| eval mfa_seen=if(searchmatch("mfa_challenge=true"), "yes", "no")
| where mfa_seen="no"
| table _time, src_ip, fail_count, distinct_users_targeted, success_count, users_targeted
| sort -fail_count
```

### Microsoft KQL

```kql
let ThresholdWindow = 10m;
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where AppDisplayName has "My TELUS" or AppDisplayName has "myTELUS-Portal"
| summarize FailCount = countif(ResultType != "0"), SuccessCount = countif(ResultType == "0"), DistinctUsersTargeted = dcount(UserPrincipalName), UsersTargeted = make_set(UserPrincipalName, 25) by IPAddress, bin(TimeGenerated, ThresholdWindow)
| where FailCount >= 15 and DistinctUsersTargeted >= 10 and SuccessCount >= 1
| project TimeGenerated, IPAddress, FailCount, SuccessCount, DistinctUsersTargeted, UsersTargeted
| order by FailCount desc
```

### Sigma

```yaml
title: Credential Stuffing Against Consumer Telecom Self-Serve Portal Login
id: 6f2a1e0c-3d4b-4a7e-9c1f-2b8e5f6a1d70
status: experimental
description: Detects a high-volume mixed failure/success authentication burst from a single source against a consumer telecom self-serve account portal, consistent with credential-stuffing account takeover using passwords compromised from a third-party breach corpus.
references:
  - https://www.securityweek.com/telus-warns-customers-of-account-breaches/
  - https://attack.mitre.org/techniques/T1110/004/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
  - attack.credential-access
  - attack.t1110.004
  - attack.reconnaissance
  - attack.t1589.001
  - attack.initial-access
  - attack.t1078
logsource:
  category: authentication
  product: web
detection:
  selection_fail:
    outcome: failure
  selection_success:
    outcome: success
  timeframe: 10m
  condition: selection_fail | count(user) by src_ip >= 15 and selection_success | count() by src_ip >= 1
falsepositives:
  - Misconfigured mobile app retrying stale cached credentials at scale
  - Corporate NAT/proxy egress IP shared by many legitimate customers with unrelated forgotten passwords
level: high
```

**Known false positives:**

- Shared corporate/carrier-grade NAT egress IP generating incidental failed logins from unrelated customers
- Mobile app update causing mass token-refresh failures that resemble a failure burst

**Tuning notes:** Tune fail_count/distinct_users_targeted thresholds to the portal's real traffic baseline; exclude known corporate NAT egress ranges via an allowlist lookup; correlate with breached-password-screening service hits to raise confidence before alerting on-call.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Credential-Stuffing Burst Against Consumer Portal Sign-In (Sentinel) (locked: unlock with TL Creds)
- New-Context Session Rapidly Enumerating Billing, Payment-History and Subscription Data (Sentinel) (locked: unlock with TL Creds)
- Unverified Plan Change / Port-Out Shortly After Risky Sign-In (Sentinel) (locked: unlock with TL Creds)
- Sigma: Credential Stuffing Burst Against Consumer Self-Serve Portal (locked: unlock with TL Creds)
- Sigma: New-Context Session Enumerating Billing, Payment-History and Subscription Data (locked: unlock with TL Creds)
- Sigma: Unverified Service/Plan Change or Port-Out Following Risky Login (locked: unlock with TL Creds)
- Anomalous Post-Login Bulk Access to Billing, Payment-History and Subscription Data via My TELUS Dashboard (locked: unlock with TL Creds)
- Unauthorized Post-Takeover Plan Change / Port-Out Request Consistent with Carrier-Switch Impersonation Fraud (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Telus Warns Customers of Account Breaches](https://www.securityweek.com/telus-warns-customers-of-account-breaches/)
- [Telus confirms some customers' personal information exposed in data breach](https://mobilesyrup.com/2026/09/11/telus-customer-information-exposed-data-breach/)
- [Telus Warns Customers After Extended Account Breach](https://www.cloudlinktech.com/news/telus-warns-customers-after-extended-account-breach/)
- [Telus: Telus confirms some customers' personal information exposed in data breach](https://blog.rankiteo.com/tel1789172982-telus-breach-september-2026/)
- [Telus Warns Customers of Account Breaches - Live Threat Intelligence](https://radar.offseq.com/threat/telus-warns-customers-of-account-breaches-7a8ea152a8c3c3f7)
- [Telus Warns Customers of Account Breaches (syndicated)](https://www.itsecuritynews.info/telus-warns-customers-of-account-breaches/)
- [Telus accounts accessed in 'data security incident,' company says](https://www.ctvnews.ca/vancouver/article/telus-accounts-accessed-in-data-security-incident-company-says/)
- [Telus Customers Warned After Unauthorized Access to Personal Information](https://news.ssbcrack.com/telus-customers-warned-after-unauthorized-access-to-personal-information/)
- [Inside the Telus Digital Breach: How ShinyHunters Stole Nearly 1 Petabyte Through a Single Credential (related, distinct incident)](https://breached.company/telus-digital-shinyhunters-petabyte-breach-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2491