T-Mobile Physically Disconnected System to Expel Chinese Hackers from Network

T-Mobile's Response to Cyber Intrusion

T-Mobile's cybersecurity team identified and removed Chinese government-backed hackers, known as Salt Typhoon, from its network in 2024. This action was taken during a period of industry-wide intrusions by Beijing aimed at acquiring customer data and information on U.S. government officials.

Physical Disconnection Method

To contain the breach, T-Mobile resorted to physically disconnecting a compromised system. After months of searching, unusual activity was detected on one of its systems originating from a router belonging to another telecom company. T-Mobile's cybersecurity chief, Jeff Simon, and three others drove to a data center in Bellevue, Washington, and physically cut the cable connecting the affected box.

Broader Hacking Campaign

The Salt Typhoon campaign compromised hundreds of phone companies, internet giants, and data center providers. Affected companies included AT&T, Verizon, Viasat, Charter, and Windstream. The objective was to collect phone records and information about senior U.S. government officials, including then-presidential candidates.

Impact and Prevention

T-Mobile largely avoided a widespread breach by detecting the activity early and taking decisive action. The physical disconnection prevented further access and data exfiltration from the compromised system, mitigating the potential impact of the broader hacking campaign on its network.