In 2024, T-Mobile’s cybersecurity team took decisive action to thwart a widespread hacking campaign backed by the Chinese government. During a series of coordinated breaches targeting major U.S. telecom companies, T-Mobile successfully avoided a major network compromise by identifying malicious activity early. The intrusions were orchestrated by a group known as Salt Typhoon, which aimed to collect phone records and sensitive information related to prominent U.S. government officials and presidential candidates.

Salt Typhoon’s hacking spree affected numerous industry giants, including AT&T, Verizon, Viasat, Charter, and Windstream, compromising hundreds of companies’ networks in the process. Unlike these victims, T-Mobile’s security staff spent months hunting for threats within their systems and eventually uncovered suspicious behavior traced back to a router linked to another telecom provider. This discovery prompted an extraordinary physical intervention by T-Mobile’s cybersecurity chief, Jeff Simon, and his colleagues.

To decisively sever the hackers’ access, the team drove to a nearby data center in Bellevue, Washington, and physically cut the cable connecting the compromised system to external networks. This direct and unconventional method effectively expelled the intruders and prevented a broad-scale data breach that could have exposed sensitive customer and governmental information. Despite efforts by TechCrunch to obtain comments, T-Mobile did not provide an official statement on the incident.

The Salt Typhoon campaign is part of a larger pattern of cyber espionage targeting critical U.S. infrastructure and private sector entities, highlighting the increasing risks faced by telecom providers. T-Mobile’s response underscores the importance of early detection and rapid containment in cybersecurity defenses, especially as nation-state actors become more aggressive in their attempts to infiltrate vital communication networks.