[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAVkp9OQxUfpNA1DHTtevWezVxAi_JiqxcDzyJC8xGNM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"3a7d2ae6-20dd-4fa4-8636-c33fff03e28f","compromised-credentials-enable-months-long-telus-account-takeover-campaign","69ce7730-8f93-4304-aefd-54e014368b8c","Compromised Credentials Enable Months-Long Telus Account Takeover Campaign","Attackers exploited compromised customer credentials to access Telus subscriber accounts over a four-month window, highlighting how reused or stolen passwords can grant persistent unauthorized access to sensitive personal and financial data. The breach exposed names, contact details, billing information, and partial payment card numbers — exactly the data needed to fuel SIM-swapping and account port-out fraud. The extended duration of the breach (February to June 2025) suggests insufficient anomaly detection and response controls were in place to flag unusual login patterns or unauthorized account changes. This incident matters because telecom account takeovers can cascade into broader identity theft, financial fraud, and loss of phone number control, which attackers leverage to bypass SMS-based multi-factor authentication on other platforms.","**Immediate actions:**\n- Force a password reset for all affected customers and require strong, unique passwords upon re-enrollment.\n- Implement multi-factor authentication (MFA) — preferably app-based or hardware token — for all customer account logins.\n- Place temporary holds on SIM-swap and number port-out requests until customers can be re-verified.\n\n**Long-term improvements:**\n- Deploy credential stuffing detection tools that flag high-volume or distributed login attempts using known breached credentials.\n- Adopt a zero-trust account access model requiring step-up authentication for sensitive account changes such as service transfers or billing updates.\n- Integrate with third-party breach intelligence feeds (e.g., HaveIBeenPwned API) to proactively identify and alert customers whose credentials appear in known data dumps.\n\n**Detection & monitoring measures:**\n- Establish behavioral analytics baselines to detect anomalous account activity such as login from new geographies, device fingerprint changes, or rapid sequential account modifications.\n- Set up real-time alerting and automated account freezing when high-risk actions (e.g., port-out requests) are initiated outside normal customer behavior patterns.\n- Conduct regular log reviews and SIEM correlation rules specifically targeting account takeover indicators across authentication and billing systems.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-63B – Digital Identity Guidelines (Authentication)","NIST AC-2 – Account Management","NIST AC-7 – Unsuccessful Logon Attempts","NIST SI-4 – System Monitoring","NIST IR-4 – Incident Handling","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","ITIL – Incident Management and Problem Management Practices","PIPEDA – Breach of Security Safeguards Regulations (Canada)",{},"published","2026-09-14T10:20:22.486588+00:00","2026-09-14T10:20:22.16+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Ftelus-warns-customers-of-account-breaches\u002F","telus-warns-customers-of-account-breaches-1f707a","Telus Warns Customers of Account Breaches",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]