TELUS is notifying customers about a data security incident in which unauthorized individuals gained access to a number of customer accounts.
The telecommunications company says the incident involved the use of compromised credentials to access accounts. TELUS has since taken steps to disable the affected credentials and strengthen security measures around the accounts involved.
The company says information that may have been accessed includes customers’ names, TELUS account numbers, billing addresses, telephone numbers and email addresses. Depending on the account, other information such as subscribed services, billing details, payment history and the last four digits of a payment card may also have been exposed.
TELUS says the incident does not necessarily mean that all of the information listed was accessed for every affected customer. The company is continuing to investigate the scope of the incident and determine exactly what information was involved.
Customers are being warned to be particularly cautious about unexpected phone calls, emails or text messages claiming to be from TELUS. Information obtained during an account compromise could potentially be used by scammers to make their communications appear legitimate.
TELUS is advising customers not to provide passwords, account security information or verification codes to anyone who contacts them unexpectedly. Customers who receive suspicious communications should independently contact TELUS through its official customer-service channels.
The company says it has also implemented additional security monitoring for affected accounts and is providing eligible customers with identity-protection services as a precaution.
TELUS has reported the incident to law enforcement and says it is cooperating with the relevant authorities. The investigation remains ongoing, and customers whose information is confirmed to have been affected will receive further notification from the company.
The incident highlights the importance of using strong, unique passwords and remaining alert for phishing attempts, particularly when dealing with accounts containing personal and billing information.