TELUS Digital, an AI data solutions company based in Las Vegas and a subsidiary of Vancouver-based TELUS Corporation, has notified thousands of individuals that their personal information was exposed after an unauthorized third party gained access to internal company systems. Companies that collect sensitive personal data from research participants and service providers have a responsibility to secure that information against intrusion, and the scope and duration of this incident have raised questions about how long the exposure went undetected.
TELUS Digital’s Data Breach Investigation
According to notifications filed with multiple state attorneys general, TELUS Digital identified unauthorized access to a limited number of its internal systems. An unauthorized third party gained entry to certain company systems and obtained documents containing personal information. TELUS Digital first identified the incident several weeks after the initial intrusion, and it was not until months later that the company determined the documents taken included personal information belonging to specific individuals.
The individuals affected were primarily people who had participated in research studies conducted or facilitated by TELUS Digital, as well as individuals who had signed up to provide services to the company. The personal information involved was information these participants had themselves provided when enrolling in a program or registering with TELUS Digital.
The cybercrime group ShinyHunters has publicly claimed responsibility for the intrusion, telling reporters it obtained roughly a petabyte of data from TELUS Digital’s systems. The group has stated the access was made possible using cloud credentials that were compromised in a separate, earlier breach of a third-party sales-engagement platform used by many companies in 2025. TELUS Digital has not confirmed the identity of the attackers or the full technical details of how access was obtained, stating only that its investigation into the incident’s nature and scope remains ongoing.
Business process outsourcing companies like TELUS Digital are attractive targets for cybercriminals precisely because they sit at the center of a large volume of sensitive data flowing between many corporate clients and the individuals those clients serve. A single compromise at a vendor of this size can expose personal information tied to dozens of separate companies and their customers, employees, or research subjects all at once, which is part of why this incident has drawn wide attention from security researchers and journalists alike.
Breach notifications for this incident have been filed with attorneys general in California, Iowa, Maine, Massachusetts, Montana, Nebraska, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, Vermont, and Washington, reflecting the nationwide reach of TELUS Digital’s research and service-provider network. Because this is a multi-state breach, different states have received and published different affected-resident counts based on their own filings; for example, TELUS Digital’s Washington filing reported 9,343 affected residents, while its Texas filing reported 625 affected residents. These figures are separate per-state counts rather than conflicting totals, and it is normal for a company of this size to file with dozens of state regulators separately after a single security incident.
When Social Security numbers, government identification numbers, and dates of birth are exposed together, the risk to affected individuals extends well beyond the immediate incident. This combination of data is often sufficient for criminals to attempt to open new lines of credit, file fraudulent tax returns, or impersonate victims with government agencies, which is why prompt monitoring and protective action matter even when a company offers complimentary credit monitoring services, as TELUS Digital has done here.
When Did This Breach Occur?
TELUS Digital states the unauthorized access to its systems occurred on October 18, 2025. The company says it first identified the incident on November 12, 2025, nearly a month later. It was not until March 18, 2026, more than four months after the incident was first detected, that TELUS Digital determined the documents obtained by the unauthorized party included personal information tied to specific individuals, at which point the formal notification process to affected individuals and regulators began.
What Information Was Breached?
The information exposed in the TELUS Digital breach reportedly includes full names, home addresses, complete dates of birth, Social Security numbers, and government-issued identification numbers such as passport numbers or state identification card numbers. TELUS Digital has also disclosed that a smaller subset of affected individuals may have had protected health information or financial account numbers exposed. The company has not publicly disclosed a single combined nationwide count of affected individuals, instead reporting separate figures to each state regulator as filings are processed.
What You Can Do
If you received a notification letter from TELUS Digital, take the following steps:
- Enroll in the complimentary credit monitoring and dark web scanning services TELUS Digital is offering to affected individuals.
- Place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion).
- Monitor your bank and credit card statements closely for unauthorized charges.
- Watch for phishing emails, texts, or calls referencing this breach or asking you to verify personal information.
- Consider filing your taxes early to reduce the risk of tax-related identity fraud using a stolen Social Security number.
File a Data Breach Lawsuit Against TELUS Digital
If you were notified that your personal information was exposed in the TELUS Digital data breach, you may be entitled to compensation for the risks and burdens this incident has created. Companies that collect sensitive personal information from research participants and prospective service providers are expected to secure that data against unauthorized access.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
