Sources: China-linked “Salt Typhoon” hacking campaign breached networks of US ISPs like Verizon and AT&T, potentially gaining access to US wiretap systems
AT&T, Verizon are among broadband providers breached in China-linked ‘Salt Typhoon’ hack Mastodon: @fj@mastodon.social , @adamgurri@mastodon.social , @HackyScientress@chaos.social , and @dymaxion@infosec.exchange X: @callumj , @jchengwsj , @profwoodward , @chrisrohlf , @bysarahkrouse , @briangobosox , @rondeibert , and @jchengwsj . LinkedIn: Kurt Sanger . Forums: r/cybersecurity Mastodon: Frederic Jacobs / @fj@mastodon.social : China successfully compromised for months the infrastructure used to do wiretaps on the AT&T and Verizon networks. — This is a huge “told you so” moment for the cryptographic community that has been saying that such infrastructure does present a huge risk to national security. … Adam Gurri / @adamgurri@mastodon.social : For 30 years cryptographers have been telling everyone that this is what would happen if US law enforcement and signals intelligence purposefully created backdoors https://www.wsj.com/... Jenny / @HackyScientress@chaos.social : The “lawful” intercept systems at AT&T and Verizon were targeted, and possibly breached, in a hack attributed to a Chinese state backed hacking group. — For me this incident just drives the point in that those systems should not exist in the first place. … Eleanor Saitta / @dymaxion@infosec.exchange : *Now* can we have a sensible conversation about the risks of surveillance systems? — https://mastodon.social/... [No, of course we can't.] X: Callum Jones / @callumj : And the government wonders why Apple refused to build back doors..... Jonathan Cheng / @jchengwsj : Verizon, AT&T and Lumen Technologies are among those whose networks were breached, the people said. The widespread compromise is considered a potentially catastrophic security breach and was carried out by a Chinese hacking group dubbed Salt Typhoon. https://www.wsj.com/... Alan Woodward / @profwoodward : The next time someone suggests govt should have a backdoor just show them this story https://www.wsj.com/... @chrisrohlf : You can stack cyber risk management frameworks to the sky if you'd like. But at the end of the day if your adversary has studied your system to the point they know it better than you do, you're going to lose. https://www.wsj.com/... Sarah Krouse / @bysarahkrouse : NEW: A cyberattack tied to the Chinese government penetrated the networks of major U.S. broadband providers and potentially accessed information from systems used for court-authorized wiretapping requests - w/ @dnvolz @aviswanatha @bobmcmillan https://www.wsj.com/... Brian McCarthy / @briangobosox : Damn, apparently China just picked off every federal wiretap request through all the big broadband companies.. Exclusive | U.S. Wiretap Systems Targeted in China-Linked Hack - WSJ https://www.wsj.com/... @rondeibert : Another reminder that lawful access systems (ie, backdoors) can become major sources of personal & national insecurity China🇨🇳operators penetrated networks of Verizon, AT&T & Lumen Tech @bysarahkrouse @dnvolz @aviswanatha @bobmcmillan https://www.wsj.com/... via @WSJ Jonathan Cheng / @jchengwsj : For months or longer, the hackers may have held access to network infrastructure used to cooperate with lawful U.S. requests for communications data, say people familiar with the matter. They also had access to other more generic internet traffic. https://www.wsj.com/... LinkedIn: Kurt Sanger : Did we design our own internet to support China's strategic interests? — If your organization has IT the PRC can leverage, you are a target ... and you'd be surprised by what they can leverage. … Forums: r/cybersecurity : U.S. Wiretap Systems Targeted in China-Linked Hack
Context & Ripple Effects
The report fits a broader record of China-linked activity against U.S. critical infrastructure, including Microsoft's 2023 disclosure of compromises at critical-infrastructure organizations. It also follows reports that Salt Typhoon had entered a handful of U.S. ISPs in pursuit of sensitive information in the months before this breach report.
What makes the alleged access unusually consequential is the target: systems intended to support court-authorized surveillance sit inside communications networks but carry especially sensitive data and access paths. The later debate over whether a “secure backdoor” is technically sustainable is directly relevant to the reported lawful-intercept exposure.
First-order effects
- AT&T, Verizon and the other named providers must investigate and contain a suspected intrusion that may have reached their lawful-intercept environments, not merely ordinary enterprise systems.
- Law-enforcement and national-security users of those systems face an immediate integrity and confidentiality concern: intercepted communications and the mechanisms used to obtain them may have been exposed.
Second-order effects
- Telecom operators and their vendors are likely to reassess segmentation, privileged access and monitoring around lawful-intercept platforms, raising the security burden on a tightly integrated operational environment.
- The incident strengthens scrutiny of mandated exceptional-access systems, because a capability built for authorized surveillance can become a high-value target when an attacker reaches the carrier network.
Third-order effects
- If similar compromises persist, telecom security will be treated increasingly as a national-security resilience issue rather than solely a provider-level cyber risk, with more pressure for shared defenses and oversight.
- The case underscores a durable design trade-off: concentrating sensitive interception capability can simplify authorized access while increasing the consequences of a network breach; whether policy changes follow depends on what investigations substantiate.
The trend: This is part of a wider shift in which state-linked cyber operations target the communications infrastructure and privileged access systems that underpin government and economic security.