T-Mobile Physically Disconnects Network to Expel Chinese Hackers

Key Takeaways

• T-Mobile’s cybersecurity team resorted to physically severing a network cable to expel Chinese state-sponsored hackers in 2024.
• The incident was part of a widespread espionage campaign by the group “Salt Typhoon,” targeting telecommunications and internet infrastructure across 80 countries.
• The primary objective of the campaign was to acquire phone records and communication metadata of high-ranking U.S. government officials, including past presidential candidates.
• The physical disconnection successfully mitigated the immediate threat to T-Mobile, highlighting the extreme measures sometimes necessary against sophisticated nation-state adversaries.

T-Mobile’s Drastic Measure Against Nation-State Hackers

In a striking move that underscores the escalating battle against sophisticated cyber espionage, T-Mobile’s security personnel employed an unconventional solution to a high-tech problem in 2024: physically disconnecting a network cable to sever Chinese state-backed hackers’ access to its systems. This dramatic action, detailed in a recent report by Bloomberg’s report, occurred amidst a vast espionage operation that has compromised critical telecommunications and internet infrastructure throughout the United States and globally.

The intrusion is attributed to Salt Typhoon, a Chinese government-linked hacking collective. The FBI has disclosed that this group has successfully breached at least 200 companies across 80 nations, indicating a far greater scale of compromise than initially understood. The overarching goal of this campaign was to collect sensitive phone records and communication metadata pertaining to senior U.S. government officials, including individuals who were presidential candidates at the time of the attacks.

Salt Typhoon’s Widespread Campaign

The extensive Salt Typhoon campaign has impacted numerous prominent telecommunications providers beyond T-Mobile, including AT&T, Verizon, Lumen, Charter Communications, and Windstream. The hackers systematically targeted company routers to siphon off sensitive network traffic, demonstrating a sophisticated understanding of telecommunications infrastructure.

T-Mobile’s involvement with the Salt Typhoon intrusions first came to light in November 2024. At that time, The Wall Street Journal reported that the carrier had been swept into the industry-wide campaign. While T-Mobile initially stated it found no significant impact on customer data, the FBI and CISA simultaneously issued public warnings about the espionage effort. These warnings specifically highlighted the targeting of wiretap systems, which telecom providers are legally mandated to maintain, raising significant concerns due to the extreme sensitivity of the data involved.

The Physical Disconnection

According to the Bloomberg investigation, T-Mobile’s cybersecurity team spent months diligently searching for the intruders within their network without definitive success. The breakthrough came when they identified unusual traffic patterns originating from an internal system, specifically tracing back to a router belonging to another, unnamed telecommunications company.

This critical discovery provided Jeff Simon, T-Mobile’s chief security officer, and three colleagues with the actionable intelligence they needed. Opting against the delays inherent in remote remediation processes, the team drove to a data center situated near the company’s Bellevue, Washington headquarters. There, they located the compromised hardware and, using a pair of scissors, physically severed the cable connecting it to the external network.

This decisive, low-tech intervention appears to have been highly effective. T-Mobile has subsequently stated that it largely avoided the extensive data breaches that impacted other major carriers like AT&T and Verizon. The Bloomberg report further notes that the severed cable was later framed and put on display at T-Mobile’s headquarters, serving as a tangible reminder of the incident. T-Mobile declined to comment when approached for further details on the episode.

This incident vividly illustrates the aggressive tactics required to counter an adversary capable of pivoting seamlessly between interconnected carrier networks. Salt Typhoon’s demonstrated ability to move laterally through shared infrastructure, exploiting inherent trust relationships between telecom routers, firmly establishes this campaign as one of the most significant state-sponsored intrusions in U.S. telecommunications history. FBI officials continue to describe the threat as ongoing, and the sheer volume of confirmed victims suggests that the group maintains persistent access across segments of global telecom infrastructure, even as individual companies, like T-Mobile, implement physical and digital countermeasures.

For an industry built upon principles of redundancy and continuous connectivity, a security team’s decision to employ scissors over a software patch serves as a potent reminder: sometimes, the most direct and effective method to neutralize a nation-state hacker is simply to unplug them.

What You Should Do

• Isolate and Segment Networks: Implement robust network segmentation to limit lateral movement, especially between critical infrastructure components and less secure areas.
• Monitor for Anomalous Traffic: Deploy advanced network monitoring solutions capable of detecting unusual traffic patterns, particularly those originating from unexpected sources or targeting sensitive systems.
• Review Inter-Carrier Trust Relationships: Regularly audit and strengthen security controls around any shared infrastructure or trust relationships with other telecom providers.
• Enhance Physical Security: Re-evaluate and reinforce physical security measures for critical data centers and network hubs, recognizing that even physical access can be a vector for nation-state attacks.
• Develop Incident Response Playbooks for Extreme Measures: Prepare and practice incident response scenarios that include options for physical disconnection or other drastic measures when conventional digital remediation proves insufficient against advanced persistent threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.