Cybersecurity Policy Report, T-Mobile’s Cyber Defenses Foiled Telecom Hackers, Carrier Says, (Dec 2, 2024)

By Tom Leithauser

A cyber operation that enabled Chinese government hackers to infiltrate U.S. telecom networks failed to gain access to the systems of T-Mobile US, Inc., the carrier said.

The cyber espionage operation, known as Salt Typhoon, has alarmed policy-makers in the U.S. The Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation have attributed the activity to the Chinese government and are continuing to investigate.

But the attackers failed to penetrate T-Mobile’s cyber defenses, according to Jeff Simon, the carrier’s chief security officer.

“Many reports claim these bad actors have gained access to some providers’ customer information over an extended period of time—phone calls, text messages, and other sensitive information, particularly from government officials. This is not the case at T-Mobile,” Mr. Simon said in a blog post last Wednesday.

Mr. Simon cited “misleading media reports” that lumped T-Mobile in with other Salt Typhoon victims. But he said T-Mobile’s cyber defenses thwarted hackers possibly associated with Salt Typhoon who tried to gain access to T-Mobile’s systems by hopping over from the systems of a wireline provider that connected to T-Mobile.

“We quickly severed connectivity to the provider’s network as we believe it was—and may still be—compromised,” he said. “Our defenses protected our sensitive customer information, prevented any disruption of our services, and stopped the attack from advancing.”

“We cannot definitively identify the attacker’s identity, whether Salt Typhoon or another similar group, but we have reported our findings to the government for assessment,” he noted.

“Simply put, our defenses worked as designed—from our layered network design to robust monitoring and partnerships with third-party cyber security experts and a prompt response—to prevent the attackers from advancing and, importantly, stopped them from accessing sensitive customer information,” Mr. Simon asserted.

Mr. Simon said he was among the telecom industry executives who met with White House officials on Nov. 22 to discuss Salt Typhoon (CPR, Nov. 25).

“We have shared what we’ve learned with industry and government leaders as we collectively work to combat these large-scale, sophisticated national threats,” he said. “As we all have a mutual goal to protect American consumers, we felt it was important to communicate more about what we’ve seen with providers who may still be fighting these adversaries.”

T-Mobile has not been immune from successful cyber attacks, but those attacks led the company “to undertake a cybersecurity major transformation, making a massive investment in our program,” Mr. Simon said.

He also suggested that T-Mobile’s network architecture made it harder for hackers to penetrate the carrier’s systems. Unlike other carriers that layered 5G technology on top of legacy wireless systems, T-Mobile built a stand-alone 5G network that “tends to be newer and has more security capabilities versus older 4G systems,” he explained.

“As an industry and country, we are now seeing activity from the most sophisticated cyber criminals we've ever faced, and as such, we can't make any promises with absolute certainty,” he added. “But I can tell you that our commitment to our customers is clear: T-Mobile will work tirelessly to keep customer information secure, safeguarding our network, responding swiftly to threats, and investing in security.”

MainStory: TopStory DataSecurity FederalLegislation