#### [Cyber-crime](/security/cyber_crime/)**10** More telcos confirm Salt Typhoon breaches as White House weighs in==================================================================**10** The intrusions allowed Beijing to ‘geolocate millions of individuals’———————————————————————[Jessica Lyons](/Author/Jessica-Lyons ‘Read more by this author’) Mon 30 Dec 2024 // 23:30 UTC [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in) [](https://twitter.com/intent/tweet?text=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in&url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in&summary=The%20intrusions%20allowed%20Beijing%20to%20%27geolocate%20millions%20of%20individuals%27) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) AT-&T, Verizon, and Lumen Technologies confirmed that Chinese government-backed snoops accessed portions of their systems earlier this year, while the White House added another, yet-unnamed telecommunications company to the list of those breached by Salt Typhoon.The [digital intrusion](https://www.theregister.com/2024/11/14/salt_typhoon_hacked_multiple_telecom/), which has been called the ‘worst telecom hack in our nation’s history,’ gave Beijing-backed spies the ‘capability to geolocate millions of individuals’ and ‘record phone calls at will,’ Anne Neuberger, deputy national security advisor for cyber and emerging technology, [told](https://www.whitehouse.gov/briefing-room/press-briefings/2024/12/27/on-the-record-press-gaggle-by-white-house-national-security-communications-advisor-john-kirby-38/) reporters.In a statement emailed to *The Register*, AT-&T said the foreign spies compromised ‘a small number’ of its customers in the espionage campaign and added that the PRC-backed crew had since been kicked out of its networks. ’We detect no activity by nation-state actors in our networks at this time,’ an AT-&T spokesperson said. ’Based on our current investigation of this attack, the People’s Republic of China targeted a small number of individuals of foreign intelligence interest,’ the statement added. ‘In the relatively few instances in which an individual’s information was impacted, we have complied with our notification obligations in cooperation with law enforcement.’AT-&T continues to monitor its networks and work with government officials, other telecom firms, and cybersecurity experts on the investigation, the spokesperson said. Verizon also confirmed that the Chinese intruders had accessed ‘a small number of high-profile customers in government and politics.’ A spokesperson told *The Register* that it notified these customers, and has since ‘contained the cyber incident brought on by this nation-state threat actor.’An unnamed, ‘highly respected’ cybersecurity company has also confirmed the containment, the Verizon spokesperson added.According to the operator’s chief legal officer, Verizon partnered with federal law enforcement, national security agencies, other telecom partners, and security firms upon detecting the network activity.’We have not detected threat actor activity in Verizon’s network for some time, and after considerable work addressing this incident, we can report that Verizon has contained the activities associated with this particular incident,’ Verizon’s Chief Legal Officer Vandana Venkatesh told *The Register*.Finally, Lumen Technologies, another one of the firms [reportedly breached](https://www.theregister.com/2024/10/07/verizon_att_lumen_salt_typhoon/) in the attack, told us that it has also booted the Chinese attackers out of its systems, and said it found ‘no evidence’ that customer data was accessed.’An independent forensics firm has confirmed Salt Typhoon is no longer in our network,’ a spokesperson told *The Register*. ‘In addition, our federal partners have not shared any information that would suggest otherwise.’T-Mobile’s security boss previously [spoke](https://www.theregister.com/2024/12/05/tmobile_cso_telecom_attack/) to *The Register* about the espionage campaign and said it thwarted successful attacks on its systems ‘within a single-digit number of days.’### 9 telecom firms compromised, White House saysThe companies’ admissions come as a top White House official added another unnamed firm to the breach, bringing the total thus far to nine. Neuberger previously said eight had been compromised. Only three — AT-&T, Verizon, and T-Mobile US — have confirmed the intrusion.> We believe a large number of individuals were affected by geolocation and metadata of phones; a smaller number around actual collection of phone calls and texts’The Chinese gained access to networks, essentially had broad and full access,’ Neuberger told reporters. ‘We believe that’s why they had the capability to geolocate millions of individuals, to record phone calls at will, because they had that broad access.’In one instance, the spies broke into an admin account that then gave them access to more than 100,000 routers, she added. ‘So, when the Chinese compromised that account, they gained that kind of broad access across the network,’ Neuberger said. ‘That’s not meaningful cybersecurity to defend against a nation-state actor.’The White House doesn’t yet have a number on how many total people were affected by the breach, she added.’We believe a large number of individuals were affected by geolocation and metadata of phones; a smaller number around actual collection of phone calls and texts,’ Neuberger said. ‘And I think the scale we’re talking about is far larger on the geolocation; probably less than 100 on the actual individuals.’Following the intrusion, the White House emphasized the inadequacy of voluntary cybersecurity measures against nation-state threats. The Federal Communications Commission (FCC) launched a public rule [proposal](https://www.theregister.com/2024/12/06/salt_typhoon_fcc_proposal/) requiring basic cybersecurity practices for telecom carriers. The commissioners are expected to vote on the rule by January 15.* [Blocking Chinese spies from intercepting calls? There ought to be a law](https://www.theregister.com/2024/12/11/telecom_cybersecurity_standards/)* [China’s Salt Typhoon recorded top American officials’ calls, says White House](https://www.theregister.com/2024/12/09/white_house_salt_typhoon/)* [Salt Typhoon forces FCC’s hand on making telcos secure their networks](https://www.theregister.com/2024/12/06/salt_typhoon_fcc_proposal/)* [T-Mobile US CSO: Spies jumped from one telco to another in a way ‘I’ve not seen in my career’](https://www.theregister.com/2024/12/05/tmobile_cso_telecom_attack/)In addition to the FCC’s own efforts, US Senator Ron Wyden (D-OR) has also [proposed legislation](https://www.theregister.com/2024/12/11/telecom_cybersecurity_standards/) that would require the FCC to issue binding rules for telecom systems.Plus, according to Neuberger, all of the nine telecom CEOs whose companies were hacked have signed on to the government’s 60-day Enduring Security Framework.This public-private effort aims to put in place minimum cybersecurity practices that have been agreed upon by intelligence officers, CISA, the FBI, and telecom security experts. ® [Whitepaper: Top 5 Tips For Navigating Your SASE Journey](https://go.theregister.com/tl/2386/-14369/top-5-tips-for-navigating-your-sase-journey?td=wptl2386bt) Share [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in) [](https://twitter.com/intent/tweet?text=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in&url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in&summary=The%20intrusions%20allowed%20Beijing%20to%20%27geolocate%20millions%20of%20individuals%27) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) #### More about* [China](/Tag/China/)* [Cybercrime](/Tag/Cybercrime/)* [Security](/Tag/Security/) More like these × ### More about* [China](/Tag/China/)* [Cybercrime](/Tag/Cybercrime/)* [Security](/Tag/Security/)* [Telecommunications](/Tag/Telecommunications/) ### Narrower topics* [2FA](/Tag/2FA/)* [5G](/Tag/5G/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [AT-&T](/Tag/AT%26T/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [British Telecom](/Tag/British%20Telecom/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [China Mobile](/Tag/China%20Mobile/)* [China telecom](/Tag/China%20telecom/)* [China Unicom](/Tag/China%20Unicom/)* [CISO](/Tag/CISO/)* [Comcast](/Tag/Comcast/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Cyberspace Administration of China](/Tag/Cyberspace%20Administration%20of%20China/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [EE](/Tag/EE/)* [Emergency Services Network](/Tag/Emergency%20Services%20Network/)* [Encryption](/Tag/Encryption/)* [Ericsson](/Tag/Ericsson/)* [Exploit](/Tag/Exploit/)* [Firewall](/Tag/Firewall/)* [Great Firewall](/Tag/Great%20Firewall/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Hong Kong](/Tag/Hong%20Kong/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Information Technology and the People’s Republic of China](/Tag/Information%20Technology%20and%20the%20People%27s%20Republic%20of%20China/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [JD.com](/Tag/JD.com/)* [Kenna Security](/Tag/Kenna%20Security/)* [Mobile Network](/Tag/Mobile%20Network/)* [National Broadband Network](/Tag/National%20Broadband%20Network/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [NTT](/Tag/NTT/)* [Orange](/Tag/Orange/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Semiconductor Manufacturing International Corporation](/Tag/Semiconductor%20Manufacturing%20International%20Corporation/)* [Shenzhen](/Tag/Shenzhen/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [Telecommunications Act of 1996](/Tag/Telecommunications%20Act%20of%201996/)* [TETRA](/Tag/TETRA/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [Uyghur Muslims](/Tag/Uyghur%20Muslims/)* [Verizon](/Tag/Verizon/)* [Vodafone](/Tag/Vodafone/)* [Voice over IP](/Tag/Voice%20over%20IP/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [APAC](/Tag/APAC/)* [Sector](/Tag/Sector/) #### More aboutShare [](https://www.reddit.com/submit?url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in) [](https://twitter.com/intent/tweet?text=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in&url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=More%20telcos%20confirm%20Salt%20Typhoon%20breaches%20as%20White%20House%20weighs%20in&summary=The%20intrusions%20allowed%20Beijing%20to%20%27geolocate%20millions%20of%20individuals%27) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2024/12/30/att_verizon_confirm_salt_typhoon_breach/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) **10** COMMENTS #### More about* [China](/Tag/China/)* [Cybercrime](/Tag/Cybercrime/)* [Security](/Tag/Security/) More like these × ### More about* [China](/Tag/China/)* [Cybercrime](/Tag/Cybercrime/)* [Security](/Tag/Security/)* [Telecommunications](/Tag/Telecommunications/) ### Narrower topics* [2FA](/Tag/2FA/)* [5G](/Tag/5G/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [AT-&T](/Tag/AT%26T/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [British Telecom](/Tag/British%20Telecom/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [China Mobile](/Tag/China%20Mobile/)* [China telecom](/Tag/China%20telecom/)* [China Unicom](/Tag/China%20Unicom/)* [CISO](/Tag/CISO/)* [Comcast](/Tag/Comcast/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Cyberspace Administration of China](/Tag/Cyberspace%20Administration%20of%20China/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [EE](/Tag/EE/)* [Emergency Services Network](/Tag/Emergency%20Services%20Network/)* [Encryption](/Tag/Encryption/)* [Ericsson](/Tag/Ericsson/)* [Exploit](/Tag/Exploit/)* [Firewall](/Tag/Firewall/)* [Great Firewall](/Tag/Great%20Firewall/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Hong Kong](/Tag/Hong%20Kong/)* [Identity Theft](/Tag/Identity%20Theft/)* [Incident response](/Tag/Incident%20response/)* [Information Technology and the People’s Republic of China](/Tag/Information%20Technology%20and%20the%20People%27s%20Republic%20of%20China/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [JD.com](/Tag/JD.com/)* [Kenna Security](/Tag/Kenna%20Security/)* [Mobile Network](/Tag/Mobile%20Network/)* [National Broadband Network](/Tag/National%20Broadband%20Network/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [NTT](/Tag/NTT/)* [Orange](/Tag/Orange/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Semiconductor Manufacturing International Corporation](/Tag/Semiconductor%20Manufacturing%20International%20Corporation/)* [Shenzhen](/Tag/Shenzhen/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [Telecommunications Act of 1996](/Tag/Telecommunications%20Act%20of%201996/)* [TETRA](/Tag/TETRA/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [Uyghur Muslims](/Tag/Uyghur%20Muslims/)* [Verizon](/Tag/Verizon/)* [Vodafone](/Tag/Vodafone/)* [Voice over IP](/Tag/Voice%20over%20IP/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [APAC](/Tag/APAC/)* [Sector](/Tag/Sector/) #### TIP US OFF[Send us news](https://www.theregister.com/Profile/contact/)[#### How Androxgh0st rose from Mozi’s ashes to become ‘most prevalent malware’Botnet’s operators ‘driven by similar interests as that of the Chinese state’Cyber-crime7 days -| 3](/2024/12/24/androxgh0st_botnet_mozi/?td=keepreading) [#### US reportedly mulls TP-Link router ban over national security riskupdated It could end up like Huawei -Trump’s gonna get ya, get ya, get yaSecurity13 days -| 57](/2024/12/18/us_govt_probes_tplink_routers/?td=keepreading) [#### How Chinese insiders are stealing data scooped up by President Xi’s national surveillance systemFeature ‘It’s a double-edged sword,’ security researchers tell The RegPublic Sector23 days -| 53](/2024/12/08/chinese_insiders_stealing_data/?td=keepreading) [#### Why AI builds best on private cloudsAI projects under pressure to show real value in the tightest of timeframes might be worth keeping on-premisesSponsored Feature](/2024/10/29/why_ai_builds_best_on/?td=keepreading) [#### Blocking Chinese spies from intercepting calls? There ought to be a lawSen. Wyden blasts FCC’s ‘failure’ amid Salt Typhoon hacksSecurity19 days -| 17](/2024/12/11/telecom_cybersecurity_standards/?td=keepreading) [#### China’s Salt Typhoon recorded top American officials’ calls, says White HouseNo word yet on who was snooped on. Any bets?CSO22 days -| 24](/2024/12/09/white_house_salt_typhoon/?td=keepreading) [#### Ransomware scum blow holes in Cleo software patches, Cl0p (sort of) claims responsibilityBut can you really take crims at their word?Security14 days -| 1](/2024/12/16/ransomware_attacks_exploit_cleo_bug/?td=keepreading) [#### It’s only a matter of time before LLMs jump start supply-chain attacksInterview ‘The greatest concern is with spear phishing and social engineering’Security2 days -| 47](/2024/12/29/llm_supply_chain_attacks/?td=keepreading) [#### How cops taking down LockBit, ALPHV led to RansomHub’s meteoric riseCut off one head, two more grow back in its placeCyber-crime3 days -| 4](/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/?td=keepreading) [#### US names Chinese national it alleges was behind 2020 attack on Sophos firewallsAlso sanctions his employer — an outfit called Sichuan Silence linked to Ragnarok ransomwareCyber-crime20 days -| 4](/2024/12/11/sichuan_silence_sophos_zeroday_sanctions/?td=keepreading) [#### Suspected LockBit dev, facing US extradition, ‘did it for the money’Dual Russian-Israeli national arrested in AugustCyber-crime8 days -| 18](/2024/12/23/lockbit_ransomware_dev_extradition/?td=keepreading) [#### Don’t fall for a mail asking for rapid Docusign action — it may be an Azure account hijack phishRecent campaign targeted 20,000 folk across UK and Europe with this tactic, Unit 42 warnsCyber-crime12 days -| 17](/2024/12/19/docusign_lure_azure_account_takeover/?td=keepreading)
Related Tags:
NAICS: 923 – Administration Of Human Resource Programs
NAICS: 517 – Telecommunications
NAICS: 92 – Public Administration
NAICS: 51 – Information
ALPHV
Noberus
BlackCat
Sodinokibi
REvil
Associated Indicators: