TELUS Digital has confirmed it is investigating a cybersecurity incident after hackers claimed they stole almost 1 petabyte of company and customer data in a prolonged breach.
The incident is attracting attention not just because of the alleged scale, but because of what TELUS Digital actually does. As a business process outsourcing (BPO) provider, the company handles customer support, AI services, moderation, and operational systems for businesses around the world.
That means a breach affecting TELUS Digital could potentially expose information linked to multiple companies and millions of people through a single attack.
What TELUS Digital has confirmed
TELUS Digital has publicly confirmed that it experienced a cybersecurity incident involving “unauthorised access to a limited number of systems”.
In a statement, the company said it had:
- Secured affected systems
- Engaged cyber forensic experts
- Involved law enforcement
- Begun notifying impacted customers where appropriate.
What hackers are claiming
The group allegedly behind the attack is known as ShinyHunters, a well-known cybercrime operation linked to a number of major global breaches.
According to reports, the hackers claim they stole close to 1 petabyte of data from TELUS Digital systems and customer environments. That is an enormous amount of information.
The attackers reportedly claim the stolen data includes:
- Customer support records
- Call centre data
- Voice recordings
- Call metadata
- Internal corporate information
- Source code
- Financial data
- Salesforce-related information
- AI moderation and support tooling data.
At this stage, these claims have not been independently verified in full.
How the breach allegedly happened
According to cybersecurity reporting, the attackers claim they gained access using Google Cloud credentials discovered in data stolen during a separate breach involving Salesloft Drift.
The alleged chain of events is significant because it highlights how one breach can potentially lead to others.
The hackers claim they:
- Found cloud credentials in previously stolen support data
- Used those credentials to access TELUS systems
- Searched internal environments for additional secrets and authentication tokens
- Expanded access into other company systems and datasets.
This approach is increasingly common in modern cyberattacks, with a successful attack against one outsourcing provider potentially exposing information connected to many different organisations at once. That is one reason cybersecurity experts increasingly view outsourcing providers as high-value targets.
Could UK customers be affected?
Yes. A notification sent by Telus International (U.K.) Ltd. confirms that some personal data was contained in systems accessed by an unauthorised third party.
According to the notice, the incident was first identified on 12 November 2025, with the company later confirming on 18 March 2026 that certain individuals’ data was contained within the affected systems.
The notice states that the exposed information may include:
- Names
- Email addresses
- Phone numbers
- Physical addresses
- Dates of birth.
TELUS Digital says it has no evidence of actual harm at this stage. However, affected individuals are being offered 12 months of monitoring services through TransUnion TrueIdentity as a precaution.
The company is also warning people to remain alert for:
- Phishing emails
- Scam phone calls
- Fake payment requests
- Messages impersonating TELUS or TELUS Digital.
That warning matters because breaches involving names, contact details, and dates of birth can increase the risk of social engineering attacks and identity fraud attempts, even where financial data is not involved directly.
The notification also suggests the incident timeline may stretch back several months before public confirmation, raising further questions about how long attackers may have had access to systems and data.
What should affected customers do?
If you believe your information may have been exposed, sensible precautionary steps include:
- Changing passwords linked to affected accounts
- Using unique passwords for different services
- Enabling multi-factor authentication (MFA)
- Monitoring bank accounts and online accounts
- Watching for suspicious emails, texts, or calls
- Being cautious of unexpected customer support contact.
We are continuing to monitor developments closely, including any further disclosures about what data was accessed and which companies or individuals may have been affected. We will provide updates as they happen.
Join the Claim connects consumers with SRA-regulated lawyers. Keep an eye out for updates on any potential claim and possible eligibility checks/registration opportunities.
