Telus warns customers their account details were accessed for 16 months
Unauthorized users with compromised credentials accessed customer names, account numbers, and billing info between February 2025 and June 2026.
The day's top stories, food & events — every morning at 7. Unsubscribe anytime.
Telus customers whose account information was accessed by unauthorized users between February 2025 and June 2026 need to take steps to protect themselves, the company warned Friday.
Unauthorized individuals used compromised credentials to gain access to customer accounts. In some cases, they contacted customers to persuade them to switch services to competitors, and in others, they made unauthorized changes to Telus services.
The compromised information includes full names, account numbers, billing addresses, preferred language, and phone numbers. In most cases, it also includes email addresses, the last four digits of payment cards on file, service types, amounts charged, and payment history.
Telus has enrolled affected customers in two years of complimentary Telus Guardian identity theft protection through Norton, with an enrollment deadline of Nov. 30, 2026. The service includes identity theft and dark web monitoring, one-bureau credit monitoring, annual credit reports and scores, up to $25,000 reimbursement for stolen funds, up to $25,000 compensation for personal expenses, up to $1 million coverage for lawyers and experts, and access to an identity restoration team. It also includes a free 90-day subscription to Norton Security Deluxe.
Telus reported the incident to Vancouver Police Department and its investigation is ongoing. The company will file a report with the Office of the Privacy Commissioner of Canada.
This is the second significant security incident for Telus in 2026. In March, hackers stole nearly a petabyte (1,000 terabytes) of data over several months and demanded $65 million in exchange for not leaking it.
How many customer accounts were accessed during this 16-month window?
What steps does Telus recommend customers take immediately beyond enrolling in the identity protection program?
We'll update this story as answers emerge.
The facts
How long were Telus customer accounts accessed without authorization?
Unauthorized users accessed customer accounts for 16 months, from February 2025 through June 2026.
What information was compromised in the Telus breach?
Full names, account numbers, billing addresses, preferred language, and phone numbers were accessed in all cases. Most affected customers also had email addresses, the last four digits of payment cards, service types, amounts charged, and payment history compromised.
What did unauthorized users do with access to Telus customer accounts?
In some cases, unauthorized users contacted customers to persuade them to switch services to competitors. In other cases, they made unauthorized changes to Telus services.
