😳 I haven’t seen this anywhere else…yet. I don’t watch legacy media so if it’s there I won’t see it.

Copied ⬇️

Pour yourself a strong coffee to sit back with this mornings read.

Dilute it if need be, with coffee becoming a luxury in Canada, where even the cheap beans at Costco run you $32 a bag…

Yesterday I talked about Loblaws hack, if you missed it, you can find that one here → LINK.

Today it’s Telus.

That makes two of Canada’s biggest corporate names, two massive data breaches, two days in a row...and if you’re keeping score at home, we’re not even halfway through March.

Telus has confirmed it is investigating a “cybersecurity incident” - their words, not mine - after a hacking group called ShinyHunters claimed to have walked out the door with somewhere between 700 terabytes and nearly a full petabyte of data. If those numbers don’t mean much to you, think of it this way…we’re not talking about one database getting cracked. We’re talking about multiple internal systems, backups and data lakes.

The whole house, friends.

Not just the front window.

And here’s the part that should genuinely make your stomach turn...

They were inside for months. Not hours. Months. Roaming around Telus infrastructure like they owned the place, hoovering up data, while Telus apparently had no idea. The attackers didn’t need some exotic, Hollywood-style zero-day exploit either. They got in through stolen cloud credentials lifted from a completely different breach somewhere else, scanned those credentials for embedded API keys and login secrets...and waltzed right in through the side door.

As in...your data wasn’t taken in a heist. It was taken in a leisurely stroll.

What’s allegedly floating around out there now?

Personal information for Telus users and employees;
Detailed call logs and voice recordings;
FBI background check information;
Source code from multiple Telus divisions;
Financial and operational records;
Data from at least 20 to 24 other companies Telus was doing business-process work for.
That last one matters. Telus Digital - the arm that got hit - isn’t just a phone company. It runs customer support, contact centres, AI data services and fraud tools for a massive chunk of Canadian enterprises.

When Telus gets popped, your data goes with it...even if your company has never had a single direct relationship with Telus.

ShinyHunters demanded $65 million dollars to keep the data under wraps. Telus, so far, hasn’t engaged.

NOW...

Here’s the part that would be hysterical, if wasn’t so wide-reaching and absolutely terrifying...

Telus sells cybersecurity services.

They publish their own “Breach Response Report.” They market themselves as the people Canadian businesses should trust to manage exactly this kind of risk. The same company that just let attackers roam their infrastructure for months has been out here selling breach protection to others.

Canada’s telecom oligopoly concentrates enormous amounts of sensitive data into a handful of players...then those same players outsource that data risk to clients who never signed up for it. When one of them gets compromised at this depth, it’s not a bad-luck story. It’s the whole model breaking down.

Change your passwords. Enable multi-factor authentication. Treat any unexpected call or email invoking Telus, your bank or “support tickets” as suspect until verified.

Having been personally hacked - network wide where they even took over my perimeter and front door cameras - erasing events and taking them offline…

Through this, losing access to old accounts that I barely even remembered having…

Losing access to my social media profiles - another place where scams will be extended through personal messaging…

I know that this can be traumatic.

But if you don’t respond now…you have no idea what will come later.

As for policing in these matters…there is none that will help protect you.

And it’s only if you lose financially that the police will open a file - something that you can give to your bank to help recoup your losses - not guaranteed - but still leaves the rest of your personal information available in circles that exist in tiny corners of the internet that you will never even find by accident.

I’ll work on another post - for those who have already been breached and for those who want to just make sure that they are as protected as possible…because like a lot of others, I never needed to know any of this information until I absolutely needed to know. Now that I do…I’ll be happy to share.

Keep eyes for updates.

https://substack.com/app-link/post?publication_id=447842&post_id=190934617&utm_source=post-email-title&utm_campaign=email-post-title&isFreemail=true&r=jdw0f&token=eyJ1c2VyX2lkIjozMjU2MDcxOSwicG9zdF9pZCI6MTkwOTM0NjE3LCJpYXQiOjE3NzM0OTc4MDgsImV4cCI6MTc3NjA4OTgwOCwiaXNzIjoicHViLTQ0Nzg0MiIsInN1YiI6InBvc3QtcmVhY3Rpb24ifQ.9Ilsj2xKaoZVTnf0qATiIJbDIwHVNI6DjDLDFST1lro