Overview
- T‑Mobile’s security team traced suspicious activity to a third‑party wireline provider and physically severed the connection at a Bellevue data center to stop the intrusion in November 2024.
- U.S. intelligence and security researchers have broadly linked the wider late‑2024 campaign that touched many carriers to Salt Typhoon, a Chinese government‑linked espionage group focused on long‑term interception.
- T‑Mobile says the attackers did not access customer content and that no calls, texts, or voicemails were taken during the incident.
- Company officials credit fast detection, network segmentation, and prior security investments for containing the breach before attackers moved into sensitive systems.
- Federal agencies and regulators have increased scrutiny of telecom supply chains and security practices after briefings at the White House, with the FCC and CISA signaling tougher expectations for vendors and carriers.