T-Mobile’s physical defense against a Chinese cyber espionage campaign

This aggressive containment strategy followed months of fruitless digital hunting as the company sought to root out Salt Typhoon, a Chinese government-backed hacking group. The group’s broader campaign, which targeted major domestic infrastructure including AT&T, Verizon, and Charter, aimed to harvest sensitive phone records and communications from high-ranking U.S. government officials and political candidates.

While the industry suffered widespread data exfiltration, T-Mobile’s early detection prevented a catastrophic breach of its internal systems. The compromised hardware, which had been channeling unusual traffic originating from a third-party telecom provider, was neutralized the moment the physical cable was snipped. This manual intervention effectively halted the unauthorized access, ending a months-long security struggle that had previously seen the attackers evade conventional detection methods.