Eastlink data breach August 2026: what the customer emails actually mean

On Friday, 28 August 2026, just before 5 p.m. Atlantic Time, Eastlink emailed some current and former customers that some accounts may have been accessed. The company said this may have occurred between late Wednesday and early Thursday morning. After learning of the incident on Wednesday, it shut down affected platforms on its website and mobile app and apologized in those emails.

CBC News reported the emails on 29 August 2026. Exposed information may include names, contact details, account numbers and PINs. Eastlink does not believe credit card or banking information may have been exposed. The number of people affected has not been made public. Eastlink’s website had no public statement at the time, and a company spokesperson said the firm was still gathering details and could not comment further until Monday.

The “no banking information” line is not the whole story

Coverage of this incident will keep leading with the same comfort: Eastlink does not believe credit cards or bank details were involved. That matches what the company told customers, and it matters. It is also not the part of the email that changes how you should behave this week.

What those emails actually flag is a different kind of leftover. Alongside a name and contact details, Eastlink warned that account numbers and PINs may have been exposed. For a cable, internet or phone account, that PIN is often the thing a call-centre uses to decide that the person on the line is you. Next to your name and account number, it is closer to a spare key than to a mailing list.

Contact details mean someone holding this information also knows how to reach you — on the same channels Eastlink itself would use. The warning covered current customers and former customers. If you left years ago, you may not be watching for this at all.

None of that means a bank account was emptied. It means the useful remainder, if the access was real, is a package that makes impersonation easier: who you are, how to contact you, which account is yours, and the code meant to protect it. Eastlink has not said whether anyone actually copied the data, only that accounts may have been accessible in that window. That uncertainty cuts both ways. It is not a reason to ignore the PIN.

What to actually expect

• If Eastlink put you on the notification list, the warning went out Friday, 28 August 2026, just before 5 p.m. Atlantic Time. The company has not published who was included, and former customers were in scope, so not seeing an email is not a clear all-clear.
• Affected parts of the website and mobile app were shut down after Eastlink learned of the incident on Wednesday. You may find you cannot log in or manage your account as usual until those platforms return.
• As of the 29 August 2026 CBC report, Eastlink was still gathering details and would not say more until Monday. How many people were involved, and what exactly happened, were not public yet.
• Fake follow-up messages often trail a warning like this. The real emails already went out on Friday. A new note asking you to confirm a PIN, click a link, or read out account details is not something to answer.

What you can and cannot fix

If a name, contact details, account number or PIN from this incident was accessed, that information cannot be pulled back. It is out. No company can recall it, and nobody can honestly sell you “removal” of the breached records.

• Change your Eastlink PIN as soon as you have a genuine way to do it — through the company once its platforms are back, or through a contact method you already know is theirs, not a link in a fresh email. Do not reuse the old PIN on Eastlink or anywhere else.
• Assume a stranger may already know your name, how to reach you, and your account number. If someone calls or emails about your Eastlink account and asks you to confirm a PIN, a payment, or a “security check,” stop. Use a number or app you already had, not one they provide.
• When you can see the account again, look for changes you did not make: new services, altered contact information, extra lines, or forwarding. Those are the near-term traces that matter here.
• A bare leaked record becomes more useful to a scammer when it is joined to public people-search listings that add relatives, phone numbers, employers and previous addresses. Those listings, unlike the Eastlink data, can actually be removed. Reducing that extra public footprint is one of the few levers that still belongs to you.