T-Mobile Detected and Physically Cut Off Salt Typhoon Hack in 2024, Averting Major Damage
In 2024, T-Mobile discovered and expelled hackers who had infiltrated its network as part of a broad industry attack by the Salt Typhoon group, which had affected hundreds of telecom and internet companies. The carrier avoided widespread damage by detecting abnormal activity and physically severing cables at a data center in Bellevue, Washington. Security chief Jeff Simon and three colleagues used scissors to cut the compromised device's external connections. T-Mobile has not yet responded to comment requests.
In 2024, U. S. telecom operator T-Mobile discovered and expelled hackers who had infiltrated its network. The intrusion occurred during a broad industry-wide attack wave aimed at stealing customer data. The hacking group Salt Typhoon had previously affected hundreds of telecom and internet companies, with activities targeting the collection of phone records and information on senior U. officials. Other affected companies included AT&T, Verizon, satellite phone network Viasat, and network infrastructure firms Charter and Windstream.
T-Mobile avoided large-scale network damage by detecting abnormal activity early. After months of searching, its cybersecurity team found unusual instructions on a system, originating from a router belonging to another unnamed telecom company. Upon confirming the intrusion, security chief Jeff Simon and three colleagues drove to a data center in Bellevue, Washington. After locating the compromised device, they used scissors to cut the cables connecting it to the external network. As of now, T-Mobile has not responded to requests for comment.