Telus, a Canadian national telecommunications company is looking into whether employeesâ data as well as the source code for the system were stolen and then sold on a dark web marketplace.
Subsequently, the threat actor published screenshots that appear to depict the companyâs payroll data and private source code repositories.
âWe are investigating claims that a small amount of data related to internal Telus source code and select Telus team membersâ information has appeared on the dark web,â Richard Gilhooley, director of public affairs at Telus said in an email.
âWe can confirm that to this point our investigation, which we launched as soon as we were made aware of the incident, has not identified any corporate or retail customer data.â
Source Code, Employee Data Stolen
A threat actor offered what they claimed to be TELUSâ employee list (including names and email addresses) for sale on a data breach forum on February 17.
âToday weâre selling email lists of Telus employees from a very recent breach. We have over 76k unique emails and on top of this have internal information associated with each employee scraped from Telusâ APIâ, the forum post says.
The post provides what looks to be a list of email addresses for Telus employees as proof. âIt isnât known if these are the current or former staff â or even realâ.
Later on Tuesday, February 21, the same threat actor published a new forum post with an offer to sell TELUSâ private GitHub repositories, source code, and payroll data.
âIn the repositories are the backend, frontend, middleware [information,] AWS keys, Google auth keys, Source Code, Testing Apps, Staging/Prod/testing, and more!â says the sellerâs latest post.
The seller also stated that the companyâs âsim-swap-api,â which is supposed to allow attackers to conduct SIM swap attacks, was included in the stolen source code.
Despite the malicious attacker calling this a âFull breachâ and stating that they will sell âanything related to Telus,â it is still too soon to say whether an event actually happened at TELUS or whether a breach at a third-party vendor actually occurred.
âItâs important to note that itâs not clear whether the data being sold is realâ, commented Brett Callow, a British Columbia-based threat analyst for Emsisoft.
âIf it is real, this is a potentially serious incident which exposes Telusâ employees to increased risk of phishing and social engineering and, by extension, exposes the companyâs customers to riskâ.
âThe alleged exposure of the private Github repositories, supposedly including a sim-swap API, represents an additional tier of potentially significant risk.â