Stolen credentials and a government-looking inbox did more damage this week than any novel exploit your firewall was built to catch.

Telus spent months with attackers sitting inside subscriber accounts, reading personal data and billing records like a bored customer-service intern. Revolut confirmed on September 12 that someone posing as a government agency, from an address on that agency’s own domain, walked out with identity packs. If your cybersecurity program still congratulates itself on dropped brute-force noise at the edge, you’re scoring a drill your adversaries already skipped.

Subscriber portals ran hot for months

SecurityWeek’s Telus write-up is grim in a very ordinary way. Stolen credentials powered a multi-month campaign against subscriber accounts. The haul was personal data and billing records. That’s a customer-identity failure with dwell time your quarterly tabletop never models.

You already know the mechanics. Password reuse. Credential stuffing against a portal that treats a correct password as a finished identity check. Maybe infostealer leftovers from a home PC. None of that needs a new CVE. It needs a live session and a billing page that will render.

Billing history is a reset kit for every other account that customer owns.

Threat detection that hunts shells and C2 will file this traffic as an authenticated user. Your SOC’s threat-protection stack is probably tuned for malware callbacks, not a strange ASN paging through invoices at 2 a.m. Defense in depth on the slide deck still often means a firewall rule and an endpoint agent. The portal sits outside both, on purpose, because customers have to reach it.

If you run a similar stack, pull 90 days of customer-IAM logs. Look for new devices, new geos, and bulk record views on accounts that never opened a ticket. That’s the hunt Telus customers now get as a polite notice. This is a bad look for any team that told the board customer IAM was a solved project.

Cybersecurity still waits for a break-in

Revolut’s incident is the other valid-access path, and it’s uglier if you store KYC. Help Net Security reports an impersonator used mail on a government agency’s domain and obtained sensitive customer records. The London fintech says a limited number of customers were affected and that it contacted them. The notice listed birth dates, postal and email addresses, phone numbers, and copies of passports and driving licences.

A domain match is not a warrant.

Someone in the request chain treated “looks like the government” as enough authorization to export the identity-proofing stash. That’s a process bug on legal-sounding stationery. Your cyber security review of vendors probably asked about encryption at rest. It probably skipped who can fulfill a regulator-shaped email without a second channel.

WhatsApp’s Restricted Chat setting, in Android beta 2.26.36.5, makes the same point from the consumer side. Turn it on and a conversation stays on the primary phone. Sync to WhatsApp Web and secondary devices dies. A messenger is admitting, in product copy, that a linked session is another copy of the chat.

You should treat every linked device, OAuth grant, and official-looking export mailbox the same way. If the session can read, it can leak. Incident response that starts at packet capture will arrive after the passport PDF has left.

Revoke the copy you never meant to keep

Security hardening here is dull, and it works. You don’t need a new platform. You need to treat customer portals, KYC export desks, and linked sessions as production admin planes.

Do this now.

Immediate. Force re-auth and step-up on any view or export of billing, government ID, or a full customer 360. Kill sessions older than your actual support shift. Review 90 days of portal auth for stuffing patterns, reused passwords, and bulk reads.

Immediate. Take data-request fulfillment off the inbound email thread. Call back on a number you already hold. Require two-person approval for ID-document export. Log the requester, the legal basis, and the file hash.

Immediate. Inventory linked devices and OAuth grants on every app that holds customer or staff chat. Revoke unknown secondaries. If a messenger can pin a chat to one phone, your internal tools can pin an admin role to one workstation.

Ongoing. Fold account-takeover analytics into threat detection. Point incident response at session revocation and copy recall first. Keep malware controls in place, and add export-path monitoring so defense in depth actually covers the desk that answers official mail.

You can’t patch a password that already works, or an email that already looks official. You can make both paths loud, expensive, and short-lived. Start with the sessions still open tonight.

Sources

• Telus Warns Customers of Account Breaches
• What we know about the Revolut data breach so far
• WhatsApp Restricted Chat locks a conversation to your primary phone