T-Mobile cuts cable to expel Chinese hackers from network

Most companies discover they have been hacked months after the fact, usually from a journalist’s phone call or an FBI tip. T-Mobile’s version of events in November 2024 reads differently: engineers spotted the intrusion early, identified the entry point, and cut the connection before anything sensitive walked out the door.

That entry point was a third-party wireline provider’s network, and the moment T-Mobile’s security team traced the activity back to it, they severed the link entirely. Chief Security Officer Jeff Simon said no customer data, including calls, texts, or voicemails, was accessed during the incident.

What Salt Typhoon actually does

The group behind the broader campaign, widely identified by US intelligence and security researchers as Salt Typhoon, is a Chinese state-sponsored hacking operation with a specific interest in telecommunications infrastructure. Its playbook is not ransomware or financial theft. It is espionage, the quiet, patient kind designed to intercept communications from high-value targets over extended periods.

T-Mobile was careful not to definitively name Salt Typhoon as the culprit in its own case, citing similarities in tactics rather than confirmed attribution. The tactics observed, however, matched closely enough that the company briefed US government officials and participated in discussions at the White House about mitigation strategies across the telecom sector.

Salt Typhoon’s campaign throughout late 2024 compromised multiple US telecommunications providers, with AT&T and Verizon reported as among the carriers that suffered deeper breaches. Those intrusions potentially exposed communications of high-profile individuals to foreign surveillance.

Why T-Mobile’s response looks different

The contrast between T-Mobile’s outcome and what happened at its competitors comes down to two things: detection speed and network architecture. T-Mobile’s engineers caught the intrusion early enough that the attackers had not yet moved laterally into sensitive systems. Network segmentation appears to have been a meaningful factor in containing the damage.

T-Mobile has been investing in security infrastructure for several years, in part driven by regulatory pressure following earlier, unrelated data breaches. The company reached a settlement with the Federal Trade Commission in 2023 over prior incidents, which required specific security improvements.

The company also reported experiencing no service disruptions as a result of cutting the third-party connection.

The bigger picture for telecom and critical infrastructure

The Salt Typhoon campaign is a coordinated, ongoing effort targeting the backbone of US communications infrastructure, and the November 2024 revelations made clear that multiple carriers were inside the blast radius simultaneously.

The FCC and CISA have both signaled heightened attention to telecom security requirements in the wake of the broader Salt Typhoon disclosures. T-Mobile’s ability to say, credibly, that its customers’ data was not accessed is a meaningful competitive differentiator in an environment where its two largest rivals are dealing with the fallout from deeper breaches.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.