HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)PHIMediumContained

TELUS International AI Inc.

bd_fd4ab6b859739e28 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 12, 2025

Filed

Apr 17, 2026

To disclose

22 weeks

Affected

9,343state residents only

Linked

4 filings

Confidence

69%

Full breach record for TELUS International AI Inc. →

TELUS International AI Inc. notified Washington residents of a data security incident involving unauthorized access to systems. The breach impacted personal information (names, contact info, DOB) of research participants and service providers, with limited health and financial data in some cases. Discovery was November 12, 2025; notification began April 17, 2026. 9,343 Washington residents affected. Forensic experts and law enforcement were engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 25 days

discovery → filing · 22 weeks / 156 days

Oct 18, 2025

Begins

Nov 12, 2025

Discovered

Apr 17, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Nebraska State AGbd_95bd0c788b77a27f2026-07-29 · +103dVerified
Vermont State AGbd_238d07dfd53f693f2026-07-31 · +105dVerified
Texas State AGbd_f6c5948be36d562d2026-07-31 · +105dVerified

Name: TELUS International AI Inc.
norm: telus international ai

Name: TELUS International AI Inc.
norm: telus international ai
Industry: Technologyllm

Discovered: Nov 12, 2025
Breach occurred: Oct 18, 2025 – Mar 2, 2026
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 17, 2026
Affected individuals: 9,343state-resident count only
Data types: Identity (basic)Health (basic)Financial account
Data elements: NameDate of birthMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Worked with law enforcement
Initial access: valid_credentials

During the incident: Launched an investigation alongside leading cyber forensics experts
Worked with law enforcement
Began mailing letters to individuals whose information was determined to be involved
Sending emails to other affected individuals
Offering complimentary cyber monitoring services
Changes made: Increased security measures to meet the continually evolving threat landscape
Employee training to recognize external attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(156 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGApr 17 · first · this page

Nebraska State AG+103d

Vermont State AG+105d

Texas State AG+105d

Pattern: first filing Apr 17 (WA), last Jul 31 (TX) — a 105-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37809.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2026
Raw hash: 41f6274b102acb7b7d30fee5054bd8847a3c3b9a25a82832ba1b0c40f9630b2d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTELUS International AI Inc.

Victim entityTELUS International AI Inc.

Incidentdiscovered Nov 12, 2025

Stated responseLaunched an investigation alongside leading cyber forensics experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com