Loading story…
Sen. Maria Cantwell (D-WA), the ranking member of the Senate Commerce Committee, called for congressional hearings and CEO testimony from AT&T and Verizon after alleging the carriers have not cooperated with oversight requests tied to Salt Typhoon, a China-linked hacking group that infiltrated U.S. telecommunications networks. In a public letter to Committee Chair Sen. Ted Cruz (R-TX), Cantwell said she has sought documentation supporting the companies’ claims that their networks are now secure, warning that the lack of cooperation raises questions about whether U.S. customers remain exposed to ongoing risk.
Cantwell specifically said she requested network security assessments produced by Mandiant (Google-owned) and that the firm declined to provide the materials after receiving direction from AT&T and Verizon; she further alleged the carriers acknowledged the existence of assessments detailing vulnerabilities but then blocked both Congress and the assessor from sharing the findings. The reporting also reiterates the broader impact attributed to Salt Typhoon’s telecom intrusions—exposing sensitive communications involving U.S. officials and prompting federal reviews—while noting that some oversight efforts were curtailed, including the termination of the DHS Cyber Safety Review Board investigation; separately, FBI assessments cited in coverage said Salt Typhoon activity affected targets across 80+ countries and led to notifications to hundreds of organizations about potential compromise.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
Cantwell publicly urged congressional hearings requiring the CEOs of AT&T and Verizon to explain how Salt Typhoon breached their networks and what remediation had been completed. She said the companies' repeated lack of cooperation left Americans without clarity on the security of their communications.
Sen. Maria Cantwell said she had sought Mandiant network security assessments for months, but Mandiant declined to provide them after direction from AT&T and Verizon. She argued the lack of cooperation raised questions about whether the carriers' networks were truly secure.
FCC Chair Brendan Carr later pulled back the late-stage telecom cybersecurity rules, arguing that voluntary collaboration with industry was sufficient. Critics said they had seen no evidence that such collaboration was occurring.
Under outgoing Chair Jessica Rosenworcel, the FCC issued emergency rules intended to hold telecoms accountable under federal wiretapping laws and require annual cybersecurity certifications. The rules were described as addressing gaps such as the lack of multifactor authentication.
A Department of Homeland Security Cyber Safety Review Board investigation into the Salt Typhoon breaches was stopped after the Trump administration eliminated the advisory body. The move curtailed a federal oversight effort into the incident.
The FBI assessed that Salt Typhoon targeted more than 80 countries and that roughly 600 organizations were notified of potential compromise. This expanded the understood global scope of the campaign.
The Senate Commerce Committee held a hearing on Salt Typhoon and broader threats to communications networks. The hearing formed part of Congress's early oversight response to the telecom intrusions.
The China-linked group known as Salt Typhoon breached U.S. telecommunications networks, including AT&T and Verizon, in an intrusion described as occurring more than a year before February 2026. Reporting said the operation compromised lawful intercept systems and exposed sensitive communications involving senior U.S. officials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberscoop.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Major U.S. telecommunications providers have formed the **Communications Cybersecurity Information Sharing and Analysis Center (C2 ISAC)** to strengthen real-time threat sharing and collective defense after the China-linked **Salt Typhoon** campaign compromised carrier networks in the United States and abroad. The intrusions, described by Sen. Mark Warner as the worst telecom hack in U.S. history, affected multiple major providers including **AT&T, Verizon, Lumen Technologies, T-Mobile**, and others, with investigators saying the activity has been ongoing since at least 2019 and there is still no clear public evidence the threat actors have been fully removed from communications networks. Officials and reporting said the espionage campaign enabled attackers to move between telecom networks, exfiltrate large volumes of data, and in some cases listen to audio calls in real time while targeting high-value intelligence, government, and political communications. Investigators also found breaches of U.S. lawful intercept systems used for court-ordered surveillance, while a separate suspected China-linked compromise of an FBI surveillance system likely exposed phone numbers of monitored targets; the campaign has also been linked to exploitation of vulnerabilities in **Cisco** routers to gain access to telecom infrastructure.
Jun 29, 2026
A senior FBI cyber intelligence official warned that **Salt Typhoon**, a China-linked cyber espionage group tied to the widespread compromise of telecommunications infrastructure disclosed in 2024, remains an active and broad threat to U.S. public- and private-sector organizations. Speaking at *CyberTalks* in Washington, D.C., FBI Deputy Assistant Director Michael Machtinger said organizations that engaged early with the FBI and agencies such as **CISA** were more successful at mitigating the impact of the intrusions, and he emphasized that the campaign largely exploited **basic security weaknesses** rather than relying primarily on zero-days. Machtinger also assessed that Salt Typhoon is likely retaining stolen data “**in perpetuity**” for future surveillance and exploitation, noting uncertainty about how the PRC intends to use the information but expressing confidence it could enable follow-on operations. Reporting highlighted that the group accessed **dozens of telecom providers globally** in a multi-year effort and, in the U.S., targeted sensitive communications by accessing **“lawful intercept”** systems used for court-ordered wiretaps; it remains unconfirmed whether the actors have been fully removed from affected American networks. The FBI official further stated that Salt Typhoon “for certain” stole information from **well over a million Americans directly**, reinforcing the long-term counterintelligence and privacy risk posed by persistent access and large-scale data theft from telecom environments.
Jun 29, 2026
Sens. Mark Warner and Ted Cruz introduced the bipartisan **Telecommunications Cybersecurity and Resilience Act** following the Salt Typhoon espionage campaign against U.S. communications providers. The China-attributed operation compromised systems handling lawful-surveillance requests, targeted telecom companies and prominent political figures, and expanded globally; U.S. officials warn Beijing could retain stolen information indefinitely for future surveillance or exploitation. The bill would require the National Telecommunications and Information Administration to convene carriers, suppliers, cybersecurity experts, and relevant agencies to develop voluntary, telecom-specific practices within 18 months, aligned to existing federal risk-management frameworks. The guidance would be reviewed every two years or after significant incidents, while independent third-party assessors would offer voluntary certifications of providers’ adoption rather than impose mandatory federal requirements.
Sep 25, 2026