On 12 March 2026, Telus Digital—the Canadian business process outsourcing arm of telecom giant Telus—confirmed a major cybersecurity incident after the threat group ShinyHunters claimed to have stolen nearly 1 petabyte (700–1,000 TB) of data. The breach represents one of the largest data theft claims in BPO history and illustrates a dangerous pattern: credential reuse across the supply chain. Attackers did not hack Telus directly—they used credentials stolen from a prior breach at Salesloft Drift to access Telus's Google Cloud infrastructure.
What was compromised
According to the Telus Digital 2026 breach record on BreachHistory and public reporting, ShinyHunters allegedly exfiltrated data from at least 28 client companies, including:
- Voice recordings and call records — Customer support conversations, agent interactions, and call metadata
- Personally identifiable information (PII) — Names, contact details, and other customer data processed by Telus on behalf of clients
- Financial information — Payment and transaction data from client systems
- FBI background checks — Pre-employment screening and verification records
- Internal source code — Proprietary code from Telus and client applications
- Salesforce data — CRM records, support tickets, and business contact information
- AI and fraud detection data — Models, training data, and fraud analytics
- Agent performance and content moderation records — Internal operational data
ShinyHunters reportedly demanded $65 million in ransom. Telus refused to negotiate, and the company stated that business operations remained fully functional with no disruption to customer connectivity.
Technical root cause: Credential chain from Salesloft Drift
The breach was not a direct attack on Telus. Instead, it was a supply-chain credential reuse attack:
- Salesloft Drift breach (August 2025) — In 2025, threat actors compromised Salesloft's systems and exfiltrated OAuth tokens and cloud credentials from the Drift chatbot integration. More than 700 organizations were affected globally. The stolen data included Google Cloud Platform (GCP) credentials that had been stored in support tickets, configuration files, or integration logs.
- Credential harvesting — ShinyHunters scanned the stolen Drift data for authentication tokens, API keys, and cloud access credentials. They identified GCP credentials that provided access to Telus's cloud environment.
- BigQuery access — Using these credentials, attackers authenticated to Telus's Google BigQuery instance—a cloud data warehouse used for analytics and reporting. BigQuery often contains aggregated data from multiple internal systems.
- Lateral movement with trufflehog — Once inside the GCP environment, attackers deployed trufflehog—a legitimate open-source tool designed to scan for secrets and credentials in code and configs. ShinyHunters used it to discover additional passwords, API keys, and service account credentials stored in Telus's repositories and cloud metadata.
- Pivot to client data — With expanded access, the attackers moved laterally to databases and systems holding data for Telus's BPO clients—call centers, customer support platforms, and back-office operations for dozens of enterprises.
This pattern—steal credentials from one breach, reuse them to access another—is increasingly common. BPOs and outsourced service providers aggregate data from many clients; a single credential compromise can expose data belonging to dozens of organizations.
Why BPOs are high-value targets
Telus Digital provides business process outsourcing: customer support, IT services, contact center operations, and digital transformation for enterprises. As a result:
- Concentrated data — One BPO holds PII, call recordings, financial data, and operational records for many clients. A single breach affects multiple companies and millions of end users.
- Complex integrations — BPOs integrate with Salesforce, GCP, AWS, and client systems. Credentials and tokens flow through support tickets, configs, and integration logs—creating a large attack surface.
- Third-party credential exposure — When a vendor like Salesloft is breached, credentials that grant access to other vendors (e.g., Telus) can be harvested and reused. The Salesloft Drift breach was a supply-chain OAuth compromise; Telus became a downstream victim.
ShinyHunters: Tactics and context
ShinyHunters is a prolific data extortion group known for:
- Exploiting OAuth misconfigurations, stolen credentials, and cloud storage exposure
- Targeting Okta SSO, Salesforce, and marketing/analytics platforms
- Publishing data on leak sites when ransoms are refused
- Using legitimate security tools (e.g., trufflehog, AuraInspector) for malicious reconnaissance
In 2026 alone, ShinyHunters has been linked to breaches at Match Group, Panera Bread, Vertex Inc, and the broader Salesforce Experience Cloud campaign. The Telus incident fits the pattern of credential reuse from prior vendor breaches.
Recommendations for affected organizations
- Assume credential rotation — If your organization used Salesloft Drift or shared GCP credentials with Telus or similar BPOs, rotate all potentially exposed credentials immediately.
- Audit third-party access — Review which vendors have access to your data, what credentials they hold, and whether those credentials were ever exposed in prior breaches.
- Segment and limit BPO access — Ensure BPOs have least-privilege access to only the data required for their function; avoid granting broad cloud or database access.
- Monitor for data misuse — Watch for phishing, fraud, or social engineering targeting employees or customers whose data may have been in Telus systems.
Recommendations for individuals
If you have interacted with customer support for a company that uses Telus Digital (or similar BPOs), consider:
- Beware of targeted phishing — Expect calls or emails referencing past support interactions, order details, or account issues. Verify any requests via official channels.
- Monitor financial accounts — Watch for unauthorized transactions or new accounts opened in your name.
- Enable MFA — Use multi-factor authentication on critical accounts to reduce credential-based takeover risk.
Bottom line
The Telus Digital breach underscores the risk of credential chaining across the SaaS and BPO supply chain. Credentials stolen from one vendor (Salesloft Drift) were reused to access another (Telus Digital), exposing data belonging to dozens of client organizations. The use of trufflehog to discover additional secrets demonstrates how attackers weaponize legitimate security tools for lateral movement. For full breach details, timeline, and technical writeup, see the Telus Digital 2026 breach on BreachHistory.
Sources: BleepingComputer, CBC, iPhone in Canada, Nudge Security (Salesloft Drift)