(Photo by Jaap Arriens/NurPhoto via Getty Images)
T-Mobile says it stopped an intrusion potentially linked to China’s “Salt Typhoon” group after hackers tried to infiltrate the company through another carrier.
“Within the last few weeks, we detected attempts to infiltrate our systems by bad actors. This originated from a wireline provider’s network that was connected to ours,” T-Mobile Chief Security Officer Jeff Simon wrote on Wednesday.
The company shared the details to push back on media reports that China’s Salt Typhoon group had compromised T-Mobile, in addition to AT&T, Verizon, and ISP Lumen Technologies.
“Many reports claim these bad actors have gained access to some providers’ customer information over an extended period of time – phone calls, text messages, and other sensitive information, particularly from government officials. This is not the case at T-Mobile,” Simon said.
T-Mobile can’t say if its own encounters with the hackers came from China’s Salt Typhoon group. However, the company’s defenses stopped the culprits from “advancing” and prevented them from stealing any sensitive customer information or causing a disruption.
“We quickly severed connectivity to the provider’s network as we believe it was—and may still be—compromised,” Simon said.
The detail offers a hint about how Salt Typhoon orchestrated what one US senator has described as the “worst telecom hack” in the country’s history. Chinese hackers may have compromised one US telecommunications company and then used its trusted network as a launching pad to infiltrate more providers.
According to Senator Mark Warner (D-Virginia), the Chinese hackers remain in US networks despite the FBI’s ongoing effort to investigate the hacks. Kicking the Chinese hackers out won’t be easy either because it’ll require physically replacing thousands of outdated routers and switches inside US telecommunication networks, Warner said last week.
By infiltrating US networks, the Chinese hackers were able to spy on phones belonging to top US officials, including President-elect Donald Trump and his VP JD Vance. In response, the White House convened a meeting last Friday with leaders from the major telecommunication firms to address the ongoing threat.
In the meantime, T-Mobile’s Simon said on Wednesday: “We do not see these or other attackers in our systems at this time.” In an interview with Bloomberg, he also noted that T-Mobile’s engineers discovered unauthorized users running commands on the company’s network devices, possibly to probe the structure of the carrier’s network.
“That was what initially clued us into some suspicious behavior, discovery-type commands being run on some of our routers and commands that have been known to be related to Salt Typhoon,” Simon said.
Meanwhile, AT&T told PCMag last week: “We are working in close coordination with federal law enforcement, industry peers, and cyber security experts to identify and remediate any impact on our networks.”