What happened
Eastlink said an unknown third party accessed some customers' account information on Aug. 26 and 27, 2026, discovered after a burst of 'forgot username' emails. Names, contact details, account numbers, services, balances, pre-authorized payment status and account PINs were accessed; card and banking details, SINs and birthdates were not. Eastlink removed PINs on active accounts, added verification steps and offered a year of credit monitoring. (Eastlink, Aug. 27, 2026)
What it means for Canada
Account PINs and balances were exposed, which is what criminals need to pass phone verification. Contact centres relying on static PINs are weaker for it.
- Sectors
- Telecom · Contact centres · Any business verifying callers
- Tools involved
- Customer self-serve portal and app · Account PINs
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the OPC, notify affected people, keep a record of every breach
Takeaways for Canadian businesses and individuals
- BusinessStop relying on static PINs or account details alone to verify callers.
- BusinessMonitor spikes in 'forgot username' or password-reset requests; that is how Eastlink spotted the attack.
- IndividualsEastlink customers: change passwords on email and banking, and enrol in the TransUnion monitoring offered.
For the Canadian AI sector
Contact centres that use AI voice agents or automated verification should assume attackers may hold the 'secret' answers.
Written by AgentsNorth from the source below. General information, not legal or security advice.