T-Mobile cut a cable to physically expel Chinese hackers, Bloomberg reports

New reporting from Bloomberg reveals how cybersecurity staff at US phone provider T-Mobile identified and expelled Chinese hackers from its network in 2024, during a spate of industrywide intrusions by Beijing aimed at stealing customer data.

The hacks were carried out by a Chinese government-backed hacking group called Salt Typhoon. The campaign compromised hundreds of phone companies, internet giants, and data center providers, with the goal of collecting phone records and information about senior US government officials, including then-presidential candidates. Hacked companies included AT&T, Verizon, satellite phone network Viasat, and network infrastructure giants Charter and Windstream.

By and large, T-Mobile escaped a widescale breach of its network by catching the activity early — and resorted to physically cutting the cable to a compromised system, per Bloomberg. The publication said T-Mobile’s cyber staff spent months looking for suspected hackers in its network without success. Eventually, the company found unusual behavior on one of its systems coming from another router belonging to a different, unnamed telecom company.

After identifying the breach, T-Mobile’s cybersecurity chief, Jeff Simon, told Bloomberg that he and three others drove to a data center near the company’s Bellevue, Washington headquarters, found the compromised system, pulled out a set of scissors, and snipped the cable connecting the box to the outside world.

When reached by TechCrunch, T-Mobile did not provide comment.

Why it matters

Salt Typhoon’s campaign compromised some of the largest telecom and infrastructure providers in the US; T-Mobile’s account of physically severing a cable to stop the intrusion illustrates how far defenders had to go when conventional network-security tools weren’t enough to contain a state-backed adversary already inside the network.