T-Mobile was hacked as part of monthslong campaign by Chinese hackers

In October, Chinese hacker group Salt Typhoon breached multiple US companies including AT&T, Verizon, and Lumen Technologies. The Wall Street Journal reports that T-Mobile was also a victim during that Chinese spy campaign.

The Salt Typhoon cyberattack allegedly targeted US wiretap systems that monitor conversations surreptitiously. Apparently, the government-linked Chinese group wanted to access information that telecommunication companies collect for the US government.

It has only now come to light that T-Mobile was also a victim. Hackers backed by a Chinese intelligence agency successfully targeted T-Mobile during a monthslong operation to eavesdrop on the cellphone communications of high-value intelligence targets.

It's not clear what data was taken in the breach and it hasn't been confirmed if the hackers were able to attain call and communications records of T-Mobile customers. A T-Mobile spokeswoman said that the attack did not significantly impact the company.


Salt Typhoon reportedly exploited vulnerabilities such as router and switch flaws to penetrate telecom infrastructure and is believed to have utilized artificial intelligence and machine learning to enhance the operations. It was able to maintain its access to parts of the infrastructure for eight months or longer.

As part of the wider campaign, the cybercriminals accessed cellphone lines used by top-ranking government officials and politicians. The access allowed them to view call logs, unencrypted text messages and some audio from victims. This means that the hacker group was able to find out who someone talked to and when, the frequency of contacts, and possibly location data.

Apparently, the hackers had the ability to access data on any US citizen but they probably only went after counterintelligence targets.

The China-led hacking campaign highlights how legally mandated back doors could give cybercriminals access points into critical systems. It also shows that American telecom companies are highly vulnerable to attacks.