Back in October, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) acknowledged that they were investigating “unauthorized access to commercial telecommunications infrastructure by actors linked to the People’s Republic of China.” These threat actors, collectively known as “Salt Typhoon,” allegedly targeted U.S. officials and staff involved in preparations for the recently concluded presidential elections. However, just days later, The Wall Street Journal reported that the group had access to far more individuals than initially believed. Essentially, the hackers could have accessed the data of any American who is a customer of AT&T and Verizon. This list of operators has since grown, as a new report from The Journal and Reuters reveals that Salt Typhoon also infiltrated T-Mobile’s network.
The hackers are believed to have exploited various vulnerabilities, such as flaws in Cisco Systems routers, to breach the carrier’s network. They also used artificial intelligence and machine learning, according to The Journal, and remained inside some of the systems they infiltrated for over eight months. This was enough time to steal a trove of sensitive data—they allegedly accessed the phone lines of senior U.S. national security officials, as well as the call logs and unencrypted texts of their victims. The hackers also gained access to information gathered by telecom operators in response to U.S. government surveillance requests.
A company representative told The Journal that T-Mobile is “closely monitoring” the attacks and stated that its systems and data “were not significantly impacted.” They also claimed that the carrier had found no evidence that customer information was compromised in the breach.
