In a major escalation of state-sponsored cyber espionage, Chinese hackers—primarily identified as the group Salt Typhoon (also known as FamousSparrow or GhostEmperor)—breached dozens of global telecommunications firms and government agencies in a multi-year campaign.

Key Details of the Breaches

• Scale of Impact: The campaign targeted over 80 countries. In the U.S. alone, at least nine major telecom providers were compromised, including AT&T, Verizon, Lumen Technologies, T-Mobile, Charter Communications, and Windstream.
• Targeted Information: Hackers gained access to “lawful intercept” systems (wiretap platforms) used by law enforcement. They intercepted the private communications of a “limited number” of high-profile government and political figures, including then-candidates Donald Trump and JD Vance.
• Mass Data Collection: The breach exposed the call records and internet traffic metadata of millions of Americans.
• Government Agencies: Beyond telecoms, the U.S. Treasury Department confirmed a “major incident” where hackers bypassed security to access unclassified documents and employee workstations.

Tactics and Persistence

• Exploitation: The attackers exploited long-standing vulnerabilities in edge devices, particularly unpatched Cisco IOS XE network devices.
• Stealth: A separate campaign by a group dubbed GRIDTIDE (UNC2814) used SaaS API calls and Google Sheets to hide malicious command-and-control traffic, blending in with normal web activity.
• Duration: Intrusions began as early as 2019, with hackers maintaining access for “months or longer” before detection.

Response Efforts

U.S. officials at CISA and the FBI have issued hardening guidance for telecom providers. In February 2026, Google and Mandiant reported a coordinated disruption of the GRIDTIDE campaign, though experts warn the threat actors will likely rebuild their infrastructure.