What happened
Freedom Mobile notified customers that a third party used a subcontractor's credentials to access its customer account management platform between Jan. 12 and 18, 2026. Names, home and email addresses, dates of birth, phone numbers and account numbers were accessed; payment information and passwords were not. The company disabled the account and is reviewing controls over third-party access. (Freedom Mobile, March 18, 2026)
What it means for Canada
A subcontractor's login opened a telecom's customer platform for a week. Contractor and integration accounts are a common way into Canadian customer data.
- Sectors
- Telecom · Any company using contractors with system access
- Tools involved
- Customer account management platform · Contractor accounts
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the OPC, notify affected people, keep a record of every breach
Quebec Law 25: report confidentiality incidents with a risk of serious injury to the Commission d'accès à l'information (CAI)
Takeaways for Canadian businesses and individuals
- BusinessList every contractor and integration account with access to customer data and remove unused ones.
- BusinessRequire multi-factor authentication on third-party accounts.
- BusinessAlert on unusual access volumes from third-party accounts; this access ran six days.
- IndividualsFreedom Mobile says it will never ask for card numbers, banking details, passwords or PINs by email or SMS; treat such requests as fraud.
For the Canadian AI sector
The same applies to AI agents and integrations: every non-human account with access to customer data needs scoped permissions and monitoring.
Written by AgentsNorth from the source below. General information, not legal or security advice.