The Chinese state-backed hacking group known as Salt Typhoon has compromised more than a dozen major telecommunications companies worldwide, and the full scope of the damage remains unknown. That’s not speculation. It’s the assessment of U.S. intelligence officials, cybersecurity firms, and the telecom operators themselves — many of whom stayed silent for months after discovery.
The breach is one of the most significant cyber-espionage operations ever conducted against global communications infrastructure. And the industry’s response has been painfully slow.
What We Actually Know About the Scale
According to TechCrunch’s latest reporting, Salt Typhoon’s confirmed victims now include AT&T, Verizon, T-Mobile, Lumen Technologies, and Charter Communications in the United States alone. Internationally, the list extends to telecom operators across Europe, Asia, and the Middle East. The group infiltrated systems that handle lawful intercept requests — the very infrastructure governments use for court-authorized wiretapping.
Think about that for a moment. The surveillance backdoors built for law enforcement became the attack surface for a foreign intelligence service.
The FBI and CISA confirmed in late 2024 that Salt Typhoon accessed metadata — call records, timestamps, phone numbers — for potentially millions of Americans, as reported by The Washington Post. In a smaller number of cases, the attackers accessed actual call content. Among the targets: senior U.S. government officials and individuals involved in political campaigns ahead of the 2024 presidential election.
T-Mobile initially claimed its defenses held. That narrative didn’t survive scrutiny. The Wall Street Journal reported that Salt Typhoon had in fact breached T-Mobile’s network, though the company maintained that no customer data was significantly compromised. The distinction between “breached” and “compromised” is doing a lot of heavy lifting in that statement.
Lumen Technologies confirmed unauthorized access to its network but offered minimal detail. Charter Communications acknowledged the intrusion only after press reports forced the issue. This pattern — deny, minimize, then quietly confirm — has defined the telecom industry’s handling of Salt Typhoon from the start.
The campaign didn’t begin in 2024. Researchers at Microsoft Threat Intelligence traced Salt Typhoon activity back to at least 2022, meaning the group likely had persistent access to some networks for two years before detection. Two years inside systems that carry the private communications of billions of people.
Why the Industry’s Defenses Failed
Salt Typhoon exploited known vulnerabilities in network equipment, including Cisco routers and switches widely deployed across telecom infrastructure. Some of these vulnerabilities had patches available. They weren’t applied. That’s a governance failure, not a technology failure.
But the deeper problem is architectural. Telecom networks were designed for reliability and interoperability, not for defending against nation-state adversaries with unlimited patience. The lawful intercept systems that Salt Typhoon targeted — mandated by the Communications Assistance for Law Enforcement Act (CALEA) — were never built to withstand this kind of sophisticated, persistent attack. Security researchers have warned about this for years. Senator Ron Wyden called CALEA’s security requirements “woefully inadequate” in a December 2024 letter to the FCC, as reported by Reuters.
He’s right. The framework essentially requires telecom companies to maintain always-on surveillance capabilities without mandating that those capabilities be hardened against foreign exploitation. It’s a structural vulnerability baked into the system by design.
The FCC under Chairwoman Jessica Rosenworcel proposed new rules in late 2024 requiring telecom companies to submit annual cybersecurity risk management plans. The proposal met immediate resistance from industry lobbyists who argued it would impose excessive compliance costs. This is the same industry that collectively generates hundreds of billions in annual revenue and failed to patch known router vulnerabilities.
CISA and the FBI took the unusual step of publicly recommending that Americans use end-to-end encrypted messaging apps — Signal, WhatsApp — rather than standard SMS or voice calls. That recommendation was effectively an admission: the government cannot guarantee the security of the nation’s telecom infrastructure.
So where does that leave enterprise customers, government agencies, and the telecom operators themselves?
In a difficult position. The technical remediation is enormous. Salt Typhoon’s access was so deep and persistent that some security experts have questioned whether affected networks can be fully cleaned without replacing compromised hardware. Bloomberg reported that some carriers were still working to confirm whether Salt Typhoon had been fully evicted from their systems months after the initial disclosure.
And the geopolitical dimension makes remediation harder. China has denied any involvement, calling the accusations politically motivated. Beijing’s standard playbook. But the attribution from multiple Western intelligence agencies and private-sector threat intelligence firms is unusually confident and consistent. Microsoft, CrowdStrike, and Mandiant have all independently linked the campaign to Chinese state actors.
The telecom industry’s immediate priorities should be straightforward but won’t be cheap. First, accelerate the deployment of encrypted transport protocols across internal network links — not just customer-facing connections. Second, segment lawful intercept infrastructure from general network management systems. Third, implement zero-trust architectures that assume persistent compromise rather than treating the network perimeter as a reliable boundary.
None of this is new thinking. It’s been recommended by NIST and CISA for years. The difference now is that the consequences of inaction aren’t theoretical.
The Harder Question Nobody Wants to Answer
Salt Typhoon exposed a fundamental tension in Western telecom policy. Governments want backdoor access to communications for law enforcement purposes. Those same backdoors create attack surfaces for adversaries. You can’t have both secure communications and guaranteed government access. The math doesn’t work.
This isn’t a niche debate for cryptographers anymore. It’s a national security problem with real-world consequences that are now publicly documented. The CALEA framework needs to be reconsidered — not in five years through a slow regulatory process, but now.
The telecom industry will resist. It always does. But the alternative is accepting that Chinese intelligence services will continue to have access to the communications infrastructure that underpins global commerce, diplomacy, and defense. That’s not a tenable position for any serious government or enterprise.
Salt Typhoon wasn’t a one-off intrusion. It was a sustained, strategic intelligence operation that succeeded because the industry prioritized cost efficiency over security and because government mandates created the very vulnerabilities that were exploited. Until both of those conditions change, the next Salt Typhoon is a matter of when, not if.
WebProNews is an iEntry Publication