T-Mobile Thwarts China-Linked ‘Salt Typhoon’ Breach With an Unusual Fix

When T-Mobile’s security team traced a long-suspected hacker operation to a piece of equipment linked to its network, the telecom giant opted for a surprisingly effective, albeit unconventional, solution: Using scissors to literally cut the hackers off. After finding the breach, security personnel reportedly drove to a data center in Bellevue, Washington, located the compromised connection and physically cut the cable to immediately sever the hackers’ access to the system.

The incident was part of the sprawling cyber-espionage campaign attributed by U.S. authorities to “Salt Typhoon,” a Chinese state-backed hacking group that penetrated major telecommunications networks in the United States and abroad that began as early as 2024.

The FBI says the campaign ultimately affected victims across more than 80 countries. The hackers obtained phone data belonging to millions of Americans and targeted prominent political figures, including U.S. President Donald Trump, Vice President JD Vance, and members of Kamala Harris’s 2024 presidential campaign. AT&T and Verizon were also identified as other carriers that were breached.

RELATED: House Report Finds Chinese Telecom Firms Retain Foothold in Critical US Infrastructure

How T-Mobile traced the intrusion

T-Mobile’s encounter with Salt Typhoon unfolded differently from breaches at other telecommunications companies, the company’s CEO Jeff Simon said. Security personnel had spent months investigating suspicious activity before tracing it to wireline carrier interconnected with T-Mobile’s network in California and Illinois. Once the source was identified, Simon ordered the connection terminated.

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

Simon has maintained that the intrusion did not result in hackers accessing T-Mobile customers’ calls, text messages or voicemails. Earlier reporting on T-Mobile’s investigation similarly found that engineers detected unauthorized users issuing suspicious commands on network devices and removed them before they could penetrate further or access customer data.

A frayed piece of the yellow cable his team cut is now framed at the company’s Bellevue, Washington, headquarters as a “small little trophy and a remembrance,” Simon told Bloomberg as he recounted the incident.

Hack disrupted telecom networks

Other telecommunications companies were not as fortunate. Salt Typhoon’s campaign reportedly compromised multiple major providers, allowing the hackers to collect enormous quantities of call records and, in some cases, private communications. The FBI has described the operation as a broad cyber-espionage campaign targeting telecommunications infrastructure around the world.

Of particular concern was the hackers’ access to information associated with court-ordered U.S. law-enforcement requests. Such systems and records can reveal not merely customer information, but potentially who American authorities are investigating or monitoring.

U.S. officials have warned that the campaign demonstrated Beijing-linked hackers’ ability to establish persistent access inside critical communications infrastructure. The FBI has said state-backed cyber actors are increasingly capable of remaining inside networks for extended periods without detection.

Threat far from over

Investigators found that Salt Typhoon frequently exploited vulnerable network-edge devices rather than relying on exotic or previously unknown techniques. Cybersecurity agencies have consequently urged telecommunications providers to patch exposed infrastructure, improve monitoring and hunt for signs of persistent unauthorized access.

But removing Salt Typhoon from compromised networks has not ended the broader threat, authorities warn. The FBI says the group has been active since at least 2019, and its investigation has resulted in notifications to hundreds of U.S. victims and dozens of countries where activity associated with the hackers was detected. Authorities are continuing to monitor the group’s activities, the FBI noted.