Canada's Telus says attackers used stolen credentials to reach customer records over more than a year.