What happened
TELUS confirmed unauthorized access to a limited number of TELUS Digital systems, said operations were not disrupted and said it was notifying affected customers. The ShinyHunters group told Reuters it took at least 700 TB of data. BleepingComputer reported the group's claim that it got in using Google Cloud credentials found in data stolen in the 2025 Salesloft Drift breach. The data volume and entry route are the attackers' claims and were not confirmed by TELUS. (CBC News (Reuters), March 12, 2026)
Note on figures: The 700 TB figure and the entry route are claims by the attackers, as reported by Reuters and BleepingComputer.
What it means for Canada
A Canadian outsourcing provider for call centres, AI support tools and fraud services was breached; its business clients may be exposed. The claimed entry route was cloud credentials leaked in the 2025 Salesloft Drift breach.
- Sectors
- Telecom · Companies that outsource customer support · Financial services and healthcare clients
- Tools involved
- Google Cloud / BigQuery · Salesforce and Salesloft Drift · AI customer-support tools
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the OPC, notify affected people, keep a record of every breach
Quebec Law 25: report confidentiality incidents with a risk of serious injury to the Commission d'accès à l'information (CAI)
OSFI B-10 (third-party risk) for bank and insurer clients
Takeaways for Canadian businesses
- BusinessAsk outsourcing and AI vendors how they store and rotate cloud credentials and API keys.
- BusinessScan your support tickets and CRM records for exposed secrets, the way the attackers say they found TELUS's keys.
- BusinessCheck your contracts for breach-notice timelines from vendors so you can meet your own PIPEDA and Law 25 reporting duties.
- BusinessRotate any credentials ever shared with Salesloft Drift.
For the Canadian AI sector
TELUS Digital also provides AI data and AI-powered support services, so the incident is a reminder that AI supply chains hold large volumes of customer conversations and training data.
Written by AgentsNorth from the source below. General information, not legal or security advice.