T-Mobile physically cut network cable to stop Chinese attackers

Published August 15, 2026

Chinese state-linked attackers known as Salt Typhoon broke into T-Mobile's network as part of a wider spying campaign against U.S. telecom companies. T-Mobile's security team found the intruders moving in through a hacked router at another telecom company and physically cut the cable to shut them out.

Report priority
High
Involves
AT&T

What is known

Salt Typhoon exploited trust relationships between interconnected telecom company routers, letting the group move from an already compromised carrier's network into T-Mobile's systems through shared infrastructure.

What to do

The FBI says Salt Typhoon has breached at least 200 companies in 80 countries and calls the threat ongoing, so watch for official notices from your carrier if you are contacted about a data exposure.

Reported details

T-Mobile's security staff spend months searching their network for the intruders without success. They finally spot unusual traffic on an internal system that is coming from a router belonging to another, unnamed telecom company. Chief security officer Jeff Simon and three colleagues drive to a data center near T-Mobile's Bellevue, Washington headquarters, find the compromised hardware, and cut the cable connecting it to the outside world with a pair of scissors.

Salt Typhoon, a Chinese government-linked group, compromised routers at multiple U.S. telecom carriers, including AT&T, Verizon, Lumen, Charter Communications, and Windstream, to intercept network traffic and target systems telecom providers use for legally mandated wiretaps. The campaign aimed to collect phone records and communications metadata tied to senior U.S. government officials. T-Mobile's security team traced intruder activity on an internal system to traffic from a compromised router at another carrier, exploiting the trust relationships between interconnected telecom networks. Rather than wait for remote remediation, the team physically severed the cable at a Bellevue, Washington data center to cut off access immediately.

References

View Original Source