Short answer
PYUR, the consumer brand of Tele Columbus, wrote to customers from 27 October 2026 saying attackers moved data out of its network between mid-September and early October. Contract numbers, names, bank details, booking data and direct debit mandates were affected, including for some former customers. The company has not said how many people are involved.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | PYUR (Tele Columbus) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Telecommunications and cable internet |
| Country | Germany |
| Disclosed | 2026-10-27 |
| People or records affected | Not stated. Current and former customers (customer letter); no official count |
What data was exposed
- Contract number
- First and last name
- Bank account details
- Booking data
- SEPA direct debit mandate
What happened
Customers of PYUR, the consumer brand of cable and fibre operator Tele Columbus, began receiving a letter at the end of October 2026. A reader sent a copy to Borns IT- und Windows-Blog, which said he was told on 27 October that his data was affected. heise online reported on 2 November that Tele Columbus had confirmed a cyberattack on its IT infrastructure and sales operations in which data apparently left the company.
The timeline as reported
The letter says the incident took place between mid-September and early October 2026. Once the attack was detected, the attacker was locked out and “extensive protective measures” were taken. Tele Columbus told heise it informed the Bundesnetzagentur, the BSI (Germany’s federal cybersecurity agency) and the data protection authorities, and filed a criminal complaint against unknown persons.
What was taken
The letter lists the contract number, first and last name, bank details, booking data and the SEPA direct debit mandate. It says some current and former customers are involved. A reader wrote that the letter said the data came from “June 2022”, while another said theirs referred to 2019. The blog author says he does not know what the 2022 reference means, and these are reader accounts, not company statements.
Neither the number of people affected nor the identity of the attacker has been published. We found no notice on the company’s own site in the sources we read.
Why bank details and a mandate matter
A name, a contract number and an IBAN are enough to make a message look genuine. They also let a third party try to set up a direct debit in your name. In Germany you can usually have an authorised debit returned within eight weeks, and an unauthorised one for up to 13 months, according to the Deutsche Bundesbank. That makes a regular look at your statements the most useful habit. Our guide to what to do after a data breach covers the basics, and phishing messages explains how to spot the lookalike emails and texts that follow incidents like this.
Scam patterns to expect
Watch for a call from “PYUR” or “your bank” saying a debit looks suspicious and asking for a TAN to stop it. Real banks do not ask for that. Also watch for invoices or reminders that quote a real mandate. The advice in our vishing and callback scams guide applies: end the call and ring back on a number you already trust.
What is still unknown
The count, the entry point and the exact meaning of the “06.2022” reference are open. heise noted the letter’s list may not be complete. The same week, German electronics retailer notebooksbilliger.de reported a separate incident, which we cover in our report. See all breach reports for context.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails, SMS and calls that quote your real contract number or bank details to look like PYUR or your bank.
- Unauthorised SEPA direct debits taken from your account by a third party using the stolen details.
- Fake invoices or payment reminders that cite a genuine mandate or booking.
- Callers posing as PYUR billing or your bank who ask for a TAN or password to cancel a suspicious debit.
What to do if you are affected
- 01Check your bank statements back to mid-September, including small amounts. If you left PYUR years ago, check the account you used then.
- 02Return unknown direct debits through your bank. Under SEPA rules you can generally return an authorised debit within eight weeks without giving a reason, and an unauthorised one for up to 13 months.
- 03Ask your bank about a creditor block or an approved-payee list for direct debits, and enter the real recipients carefully.
- 04Do not answer unexpected contact in PYUR's name. Hang up and call back using a number from an old invoice, and never give out a password, PIN or TAN.
- 05Change your customer portal password by typing the address into your browser, and change it anywhere else you reused it.
Frequently asked questions
What did the PYUR customer letter say was taken?
According to a copy of the letter that a reader sent to Borns IT- und Windows-Blog, the data that left the network includes the contract number, first and last name, bank details, booking data and the direct debit mandate. heise adds that the list may not be complete.
Was my password or email address stolen?
Neither is named in the letter as quoted by Borns IT- und Windows-Blog. That does not prove they were safe, so change your portal password as a precaution.
I left PYUR years ago. Can I still be affected?
Yes. The letter says current and former customers are involved. One reader quoted in the blog comments said the letter referred to a mandate from 2019. That is an unverified reader report.
How many customers are affected?
No number has been published. Tele Columbus reported 2.7 million connected homes at the end of June 2026, but that is its network reach, not the number of people hit.
What if I never received a letter?
Some readers on Borns IT- und Windows-Blog said they got no letter. Those are unverified reports. If you have ever been a PYUR customer, check your account statements anyway.
Sources
- Cyberangriffe auf notebooksbilliger.de und Pÿur (Cyberattacks on notebooksbilliger.de and Pÿur), heise online, 2026-11-02
- Cybervorfälle: Telekolumbus Netz GmbH (Pyur), Binance und mehr (Cyber incidents: Telekolumbus Netz GmbH (Pyur), Binance and more), Borns IT- und Windows-Blog, 2026-11-02
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.