China-Linked Salt Typhoon Confirmed to Be Behind Recent AT&T and Verizon Cyber Attacks

• The U.S. government confirmed that the China-backed threat actor tracked as Salt Typhoon orchestrated the cyber attacks against telco giants.
• AT&T Inc., Verizon, and Lumen Technologies were said to have been targeted by the hacker group, which allegedly held access for a few months in a row.
• The telcos now say hacker activity is no longer detected in their networks, which are currently secured.

Major U.S. telecommunications companies AT&T Inc. and Verizon Communications Inc. have confirmed they were targeted by the China-linked hacking group Salt Typhoon. Both organizations assured the public that their networks are now secure, emphasizing that no ongoing intrusion has been detected.

AT&T revealed in a Saturday statement that the attackers had attempted to access information related to foreign intelligence operations. Similarly, Verizon, based in New York City, disclosed that the hackers had targeted “a small number of high-profile customers in government and politics,” but the incident was contained.

Meanwhile, AT&T declared no activity by nation-state actors in their networks is detected at this time, adding that all affected parties have been notified in collaboration with law enforcement. The breach, allegedly perpetrated by a group linked to the People’s Republic of China, targeted a limited number of individuals involved in foreign intelligence activities.

The Salt Typhoon cyber attack initially gained public attention in October after The Wall Street Journal reported intrusions in multiple U.S. telecom carriers, with AT&T, Verizon, and Lumen Technologies making the headlines. 

Subsequent investigations revealed that the hackers might have accessed systems critical to federal government operations, such as court-authorized wiretap requests.

While information on the breach has remained sparse, T-Mobile USA Inc. later announced that it detected suspicious activity involving its network-level routers. T-Mobile claimed to have successfully expelled the attackers before any customer data was compromised.

On Friday, the White House disclosed that the Salt Typhoon intrusion had impacted nine telecommunications companies. Though not all affected carriers were identified, officials acknowledged the breach's significant implications for national security. 

The Biden administration has since convened a closed-door meeting with telecom executives, including AT&T CEO John Stankey, to address vulnerabilities in the sector.