Telus Digital confirms breach as ShinyHunters claims nearly a petabyte of data
Telus Digital, the customer-experience and business services arm of Telus, confirmed on March 12 that it is investigating unauthorized access to a limited number of its systems, after the ShinyHunters extortion group claimed it had stolen close to one petabyte of data.
Telus Digital runs call centres, content moderation and AI data services for large brands around the world. If the attackers' claims hold up, the breach would reach well beyond Telus, touching the customers of the companies that outsource support work to it.
What happened
"Telus Digital is investigating a cybersecurity incident involving unauthorized access to a limited number of our systems," the company said in a statement to BleepingComputer, MobileSyrup reported. Telus said its operations continue, there is no evidence of disruption to customer connectivity or services, and it is working with forensic experts and law enforcement. It said it would notify affected customers as appropriate.
ShinyHunters told BleepingComputer it got in using Google Cloud Platform credentials found in data stolen during the 2025 Salesloft Drift breach, then used those to reach other systems. The group claims the haul includes source code, background-check records, financial information, Salesforce data, customer support call recordings and call records from Telus's consumer division. It also claims 28 well-known companies were affected; BleepingComputer said it could not confirm those claims or the size of the theft.
The group demanded US$65 million in February to keep the data from being leaked, and Telus did not respond, according to the reports. The Logic reported that Telus refused to pay.
What we don't know yet
Telus has not confirmed how much data was taken, which clients are affected or how many individuals' records were involved. Samples reviewed by Reuters suggested call recordings, source code and employee information, but the full picture rests largely on the attackers' word.
What to do
- Organizations that outsource support to Telus Digital should ask for a written account of whether their data was involved.
- Rotate any credentials or API keys that may have been exposed through Salesloft Drift or connected SaaS tools.
- Telus customers should be wary of calls or texts that cite account details and ask for payment or verification codes.
