ShinyHunters Claims Near-Petabyte Data Theft from Telus Digital After Breaching BPO Giant Through Stolen Cloud Credentials
Telus Digital confirmed a breach after ShinyHunters claimed to have stolen up to one petabyte of data using cloud credentials obtained in a prior third-party compromise.
Overview
Telus Digital, the digital experience subsidiary of Canadian telecommunications giant Telus, confirmed on March 12 that it suffered a security breach after the ShinyHunters cybercriminal group claimed to have stolen close to one petabyte of data from the company’s systems. The incident, first reported by The Register, ranks among the largest data thefts ever attributed to a single threat actor and exposes the cascading risks of third-party credential compromise in cloud environments.
How the Breach Happened
ShinyHunters told BleepingComputer that it gained initial access to Telus Digital’s infrastructure using Google Cloud Platform credentials that the group had obtained during its 2025 breach of sales engagement platform Salesloft. Once inside, the attackers reportedly used trufflehog, an open-source credential-scanning tool commonly employed by security teams for internal audits, to harvest additional secrets and pivot across Telus Digital’s cloud systems.
The attack chain illustrates a growing pattern in which credentials stolen in one breach become the entry point for subsequent intrusions at downstream organizations. Telus Digital operates as a business process outsourcer handling customer support operations for major brands, making it a high-value target whose compromise can cascade across dozens of enterprise clients.
What Was Stolen
ShinyHunters claims to have exfiltrated between 700 terabytes and one petabyte of data. According to TechRadar, the stolen trove includes customer support call recordings, proprietary source code used to run internal software, employee records containing personal information, and FBI background check results for staff. Samples of the data shared with Reuters reportedly confirmed the presence of personally identifiable information belonging to at least two dozen business customers.
The scale of the breach is staggering: one petabyte is roughly equivalent to one million high-definition films or 500 billion pages of text. For a BPO provider that processes sensitive interactions on behalf of enterprise clients, the exposure of call recordings and internal systems poses significant regulatory and reputational risk.
Company Response and Ransom Demand
Telus Digital characterized the incident as affecting “a limited number of our systems” and stated that it “took immediate steps to address the unauthorized activity and secure our systems against further intrusion,” according to The Register. The company emphasized that all business operations remained fully operational with no disruption to customer connectivity or phone services, and said it had begun notifying affected customers.
Telus Digital rejected a 65 million dollar ransom demand from ShinyHunters for the stolen data. The group has historically followed through on threats to leak data when ransom demands are refused, raising the prospect of a public data dump in the weeks ahead.
ShinyHunters Track Record
ShinyHunters is one of the most prolific data theft operations in recent years. The group has previously targeted organizations including GAP, Qantas, SoundCloud, Crunchbase, and Dutch telecom provider Odido, and compromised approximately 400 organizations through misconfigured Salesforce portals. The group’s ability to chain credentials across breaches, moving from the Salesloft compromise to Telus Digital’s Google Cloud infrastructure, demonstrates an increasingly sophisticated operational model that treats stolen secrets as reusable assets.
Broader Implications
The breach underscores the fragility of cloud credential management across interconnected business ecosystems. When a single set of cloud platform credentials can unlock a petabyte of sensitive data belonging to multiple downstream organizations, the security of every vendor in the chain becomes a shared liability. For enterprises relying on BPO providers, the incident is a pointed reminder that third-party risk assessments must extend beyond contractual assurances to include active monitoring of credential exposure across the supply chain.