How did T Mobile’s cybersecurity team detect and expel the Chinese government backed Salt Typhoon hackers from its network in 2024, what broader espionage campaign affected hundreds of telecommunications, internet, and data center companies—including AT&T, Verizon, Viasat, Charte

T-Mobile appears to have contained a limited Salt Typhoon intrusion before it became a broad network breach: investigators traced suspicious activity to a router reached through a connected wireline provider’s network, then severed that router’s external connection. The episode was part of China-linked Salt Typhoon’s wider telecommunications espionage operation, which targeted U.S. carriers and internet providers, with the apparent aim of obtaining sensitive communications and surveillance-related data. 12

• T-Mobile’s team detected anomalous traffic on an internal system and spent months tracing the access path to compromised network equipment. Reports say the attackers entered via a wireline company interconnected with T-Mobile, rather than directly penetrating customer-facing systems. 34

• In November 2024, then–chief security officer Jeff Simon and three security colleagues drove to a Bellevue-area data center, identified the compromised router or “box,” and used scissors to cut the cable carrying its external network connection. That physically isolated the device and immediately terminated the attackers’ path into T-Mobile’s environment. 35

• The wider operation was Salt Typhoon, a PRC state-sponsored espionage campaign against telecommunications and internet-service infrastructure. U.S. authorities confirmed intrusions into U.S. telecom and ISP networks; AT&T and Verizon publicly confirmed they had been targeted, while reporting and government investigations linked the campaign to other providers, including T-Mobile. 12

• The campaign’s importance was systemic: telecom networks—and especially lawful-intercept and related infrastructure—can expose communications metadata, call records, and potentially surveillance targets. The cited reporting characterizes Salt Typhoon as having compromised nine U.S. telecoms and more than 200 organizations worldwide in 2024, though the exact count and the full list of victims depend on the source and whether “targeted,” “accessed,” and “breached” are distinguished. 51

• The named companies in your question—AT&T, Verizon, Viasat, Charter, and Windstream—should not automatically be treated as identically compromised. Public reporting and investigations have varied in what they establish for each firm; the strongest public confirmation in the available evidence is that AT&T and Verizon were targets of the operation. 2