Telus Digital Confirms Security Incident After ShinyHunters Claims Data Theft
Summary
Telus Digital confirmed unauthorized access to a limited number of systems and is investigating. ShinyHunters claims it stole nearly 1 PB using credentials from the Salesloft Drift breach; the scale and affected customers remain unconfirmed.
Key points
- Telus Digital confirmed unauthorized access to a limited number of systems and is investigating what was taken and which customers were affected.
- ShinyHunters claims it stole nearly 1 petabyte of data; BleepingComputer could not independently verify the total.
- The group says it used Google Cloud Platform credentials found in data from the Salesloft Drift breach, then used trufflehog to find additional credentials and access other Telus systems.
- Data allegedly stolen includes call records and recordings, Salesforce data, source code, background checks, and financial information; named customer companies have not been independently confirmed as affected.
- Telus says business operations remain fully operational, with no evidence of disruption to customer connectivity or services. It has added security measures, engaged forensic experts, contacted law enforcement, and is notifying impacted customers as appropriate.
Article Details
- Victim Organization
- Telus Digital
- Incident Type
- Unauthorized access to company systems; ShinyHunters claims data theft and extortion.
- Data Types Exposed
- Call records and voice recordings (alleged)
- Salesforce data (alleged)
- Source code (alleged)
- FBI background checks (alleged)
- Financial information (alleged)
- Customer and business-process outsourcing data (alleged)
- Affected Records
- Unknown; no record count was reported.
- Affected Data Size
- ShinyHunters claimed to have stolen nearly 1 petabyte; BleepingComputer could not independently confirm the amount.
- Operational Impact
- Telus said business operations remained fully operational and reported no evidence of disruption to customer connectivity or services.
- Ransom Or Extortion
- ShinyHunters said it began extorting Telus in February and demanded $65 million in exchange for not leaking the data. The year was not specified; Telus reportedly did not respond to the group's emails.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsShinyHunters reportedly used Google Cloud Platform credentials found in data from the Salesloft Drift breach to access Telus systems.T1528 · Steal Application Access TokenThe article says the group has used device-code vishing to obtain Microsoft Entra authentication tokens.T1566.004 · Spearphishing VoiceThe article describes ShinyHunters using voice phishing to impersonate IT support and trick employees into providing credentials and MFA codes.
Threat Actors
Vendors
GoogleAttackers say they used Google Cloud Platform credentials found in the Salesloft Drift breach to access Telus systems.SalesforceAllegedly stolen data includes call records and voice recordings, Salesforce data, source code, background checks, and financial information.SalesloftAttackers say they used Google Cloud Platform credentials found in the Salesloft Drift breach to access Telus systems.
Products
BigQueryShinyHunters says that they discovered Google Cloud Platform credentials for Telus in the Drift data and used them to access numerous company systems, including a large BigQuery instance.Google Cloud PlatformAttackers say they used Google Cloud Platform credentials found in the Salesloft Drift breach to access Telus systems.SalesforceAllegedly stolen data includes call records and voice recordings, Salesforce data, source code, background checks, and financial information.Salesloft DriftAttackers say they used Google Cloud Platform credentials found in the Salesloft Drift breach to access Telus systems.
Tools
Industries
business process outsourcingCanadian business process outsourcing giant Telus Digital has confirmed it suffered a security incident after threat actors claimed to have stolen nearly 1 petabyte of data from the company in a multi-month breach.TelecommunicationsTelus Digital is the digital services and business process outsourcing (BPO) arm of Canadian telecommunications provider Telus, providing customer support, content moderation, AI data services, and other outsourced