Loading story…
Telus Digital confirmed it is investigating a cybersecurity incident involving unauthorized access to a limited number of systems after threat actors ShinyHunters claimed a multi-month intrusion and the theft of nearly 1 petabyte of data. Reporting indicates the alleged stolen data includes information tied to Telus’ BPO operations (which can include customer support, billing, and internal tooling for multiple client organizations) and call records associated with Telus’ consumer telecommunications business; Telus stated operations remain fully functional and said it has engaged external forensics support and law enforcement while it determines what data was taken and which customers were affected.
Additional details attributed to ShinyHunters claim the initial access path involved Google Cloud Platform (GCP) credentials that were allegedly found in data previously stolen during the Salesloft/Drift breach, suggesting credential reuse/exposure as a key risk factor. As of the reporting cited, Telus Digital had not yet appeared on the actor’s leak site, and the company had not publicly confirmed the attacker’s identity or the specific data types impacted beyond acknowledging the incident and ongoing investigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
As the investigation continued, Telus Digital said it had implemented additional security measures following the intrusion. The company maintained that there was no evidence of disruption to customer connectivity or services.
On 2026-03-12, attackers allegedly used a compromised Telus employee workstation to gain access to Crunchyroll systems and exfiltrate about 100 GB of customer data. Reported stolen data included IP addresses, email addresses, credit card details, and other customer analytics information before access was reportedly revoked about 24 hours later.
Telus Digital confirmed unauthorized access affected a limited number of systems and said it was investigating what data was taken and which customers were impacted. The company said operations remained fully operational, engaged forensic experts and law enforcement, and began notifying affected customers as appropriate.
In March 2026, ShinyHunters publicly claimed it had stolen between roughly 700 terabytes and nearly 1 petabyte of data from Telus Digital and related Telus environments. The group alleged the haul included customer datasets, call records and recordings, source code, financial data, Salesforce data, and FBI background check information.
According to reporting, ShinyHunters started demanding $65 million in February in exchange for not leaking allegedly stolen Telus data. Telus was reported not to be negotiating with the group and later rejected the ransom demand.
ShinyHunters claimed the intrusion into Telus Digital began after it found Google Cloud Platform credentials in data from the earlier Salesloft/Drift breach. The actor said it then used credential-hunting tools such as TruffleHog to expand access across Telus systems during a months-long compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcecio.com
Open sourcedatabreaches.net
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ShinyHunters** has claimed responsibility for breaching Dutch telecommunications provider **Odido** (and brand **BEN**) and stealing a much larger dataset than the company initially indicated. Odido previously disclosed that attackers accessed its customer contact system and downloaded customer data, reporting the incident to the Dutch Data Protection Authority, cutting off attacker access, and bringing in external incident-response support. Odido said the exposed data varied by customer and could include identifiers and contact details such as name, address, mobile number, customer number, email address, **IBAN**, date of birth, and some ID details (e.g., passport/driver’s license numbers and validity), while stating that Mijn Odido passwords, call/location/data/billing details, and scans of identity documents were not exposed. ShinyHunters subsequently listed Odido on its leak site and alleged theft of **~21 million records** tied to **~8 million customers**, asserting Odido downplayed the scope. The gang’s claims also include highly sensitive elements—most notably **plaintext passwords**—and additional materials such as internal corporate documents and source code, which (if accurate) would materially increase risks of credential stuffing/account takeover, identity fraud, and follow-on intrusion. At the time of reporting, the expanded dataset details (including plaintext passwords and source code) were presented as **attacker claims** rather than independently confirmed by Odido.
Jun 29, 2026
ADT disclosed that attackers gained unauthorized access to certain cloud-based environments and stole customer and prospective customer data, prompting the company to activate incident response measures, engage forensic specialists, notify law enforcement, and contact affected individuals. The exposed information included names, phone numbers, and home addresses, with dates of birth and the last four digits of Social Security numbers or Tax IDs affected in a smaller number of cases; ADT said payment information was not accessed and customer home security systems were not impacted. The disclosure followed claims by the **ShinyHunters** extortion group that it had stolen more than 10 million records and internal corporate data and would leak the information if its demands were not met. Reporting tied the intrusion to a suspected vishing attack that allegedly compromised an employee's **Okta** single sign-on account and enabled access to ADT's **Salesforce** environment, matching a broader pattern in which the group targets enterprise SSO accounts and connected SaaS platforms to steal data for extortion.
Jun 29, 2026
Charter Communications confirmed a data breach after **ShinyHunters** threatened to leak allegedly stolen data, with the group claiming it accessed the company on April 1 through a voice-phishing attack that compromised an employee's Microsoft Entra account and opened a path into Charter's Salesforce environment. The attackers said they stole **40 million customer records**, including names, contact details, plan information, support ticket data, and some customer proprietary network information, while Charter said it notified authorities and, based on the data published, no sensitive personal information or CPNI was exfiltrated. The Charter incident follows a broader ShinyHunters extortion campaign targeting enterprise single sign-on accounts and connected SaaS platforms, especially **Salesforce**. In a separate case, the group claimed it stole several terabytes of data from **ZenBusiness** via platforms including Salesforce, Snowflake, and Mixpanel, and threatened to publish the data unless the company responded. Reporting also linked the campaign to claims involving Ameriprise Financial, Infinite Campus, Bumble, Hinge, Match, OkCupid, Mercer Advisors, Beacon Pointe Advisors, and attacks affecting Instructure's Canvas platform, underscoring a repeatable pattern of social engineering, SaaS data theft, and leak-site extortion.
Jun 29, 2026