Bell (2017 breach) bell.ca Bell data breach 2017: what happened and what to do
In May 2017 Canadian telecom Bell suffered a breach that exposed over 2 million unique email addresses and 153,000 survey results, plus 162 employee records with names, phone numbers and plain text passcodes. Have I Been Pwned counts 2,231,256 accounts.
View all 13,115 breaches- Breach date
- 15 May 2017
- Affected
- 2,231,256
- Data exposed
- Email addresses, Geographic locations, IP addresses, Job titles, Names, Passwords, Phone numbers, Spoken languages, Survey results, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In May 2017 Bell, the Canadian telecommunications company, suffered a data breach that exposed customer records. The attacker leaked the data online with a message saying they were releasing a significant portion of Bell.ca's data because Bell had failed to cooperate with them, and threatened to leak more. Have I Been Pwned (HIBP) added the data the next day, in May 2017.
What was exposed
HIBP counts 2,231,256 accounts. The data included more than 2 million unique email addresses and 153,000 survey results dating back to 2011 and 2012. Across the set, HIBP lists email addresses, geographic locations, IP addresses, job titles, names, passwords, phone numbers, spoken languages, survey results and usernames.
A smaller part was more sensitive: 162 Bell employee records with names, phone numbers and plain text passcodes. Plain text means the passcodes weren't hashed or encrypted. HIBP also notes that Bell had a separate breach in 2014 that exposed 40,000 records. This page covers only the 2017 incident.
What it means for you
For most customers in the data, the exposure was an email address and survey answers, which is mainly a phishing risk. A message that names Bell and refers to a survey or account can look convincing. If you ever reused a Bell password elsewhere, change it there as well.
The company's response
HIBP's entry links to CBC News coverage of the leak. Bell's own statements aren't part of HIBP's record, and this page covers only what HIBP lists.
What to do if you were in it
- 1
Treat unexpected emails that mention the breach with suspicion
Criminals use breach details to make scam emails look real. Don't click links in a message you didn't expect. Go to the company's site by typing the address yourself.
- 2
Change the password here and anywhere you reused it
Set a new password on the affected account, then change it on every other account where you used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login where the site offers it.
- 3
Be careful with calls and texts that claim to be Bell
Phone numbers and names were in the employee records. If someone calls or texts about your account, hang up and call the number on your bill.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and Serus monitors the dark web and breach databases and alerts you when your details turn up again. Breach data can't be taken back once it has leaked, so the scan tells you what to change, not what to delete.
Frequently asked
Was I affected by the Bell 2017 breach?
Check your email address on Have I Been Pwned. If it lists Bell (2017 breach), your address was in the leaked data. A Serus free scan checks this and other breaches.
What was exposed in the Bell breach?
Email addresses, names, phone numbers, IP addresses, geographic locations, job titles, spoken languages, survey results, usernames and passwords, according to Have I Been Pwned. The passwords came from employee records.
How many people were affected by the Bell 2017 breach?
Have I Been Pwned counts 2,231,256 accounts, with over 2 million unique email addresses and 153,000 survey results.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
