T-Mobile cuts cable to expel Chinese hackers from network

Most companies discover they have been hacked months after the fact, usually from a journalist’s phone call or an FBI tip. T-Mobile’s version of events in November 2024 reads differently: engineers spotted the intrusion early, identified the entry point, and cut the connection before anything sensitive walked out the door. That entry point was a third-party wireline provider’s network, and the moment T-Mobile’s security team traced the activity back to it, they severed the link entirely. Chief Security Officer Jeff Simon said no customer data, including calls, texts, or voicemails, was accessed during the incident. What Salt Typhoon actually does The group behind the broader campaign, widely identified by US intelligence and security researchers as Salt Typhoon, is a Chinese state-sponsored hacking operation with a specific interest in telecommunications infrastructure. Its playbook is not ransomware or financial theft. It is espionage, the quiet, patient kind designed to intercept communications from high-value targets over extended periods. T-Mobile was careful not to definitively name Salt Typhoon as the culprit in its own case, citing similarities in tactics rather than confirm...