Two US security agencies have listed Comcast and the data center giant Digital Realty among the likely victims of Salt Typhoon, the Chinese hacking group that broke into major telecom carriers, Nextgov/FCW reported, citing three people familiar with the matter. The National Security Agency judged Comcast likely affected. The Cybersecurity and Infrastructure Security Agency cataloged Digital Realty as potentially compromised.
Comcast denies it. “We have worked with law enforcement and government agencies and have closely monitored our network and have found no evidence that Salt Typhoon has impacted our enterprise network,” a spokesperson said. A CISA spokesperson said the agency does not comment on individual entities. The NSA declined to comment, and Digital Realty did not answer repeated requests.
A campaign wider than first reported
The intrusions were uncovered the year before and first reported by The Wall Street Journal. AT&T and Verizon were the early names. Later reports added Charter Communications, Consolidated Communications, Windstream, Lumen Technologies and T-Mobile. The hackers got in through flaws in network devices from Fortinet and Cisco Systems, according to Digital Watch Observatory, and The Wall Street Journal reported that National Security Adviser Jake Sullivan warned telecom and technology executives in a private meeting in late 2023 that the group could disrupt ports and power grids. China has denied involvement and accused Washington of spreading disinformation.
Calls and texts of President Donald Trump, Vice President JD Vance and other officials were targeted. The spies also reached the “lawful intercept” systems that carriers use to hand communications metadata to law enforcement under government orders.
An FBI assessment, one source said, agreed with other agencies that Salt Typhoon is the most egregious national security breach by a nation-state hacking group in US history.
Who was hit, and who is looking
Nobody has a single list. CISA holds one that includes telecom and IT companies; an FBI tally shows different names. Some telecom providers have used legal strategies to avoid disclosing a compromise. At two major US operators, outside counsel told incident response staff not to look for signs of Salt Typhoon, one source said.
Marc Rogers, a telecommunications security expert, said the Comcast and Digital Realty listings confirmed a suspicion. “The Salt campaign was broader than just telcos and we have low confidence the attackers have been evicted,” he said. Many of the first-stage break-ins, he added, relied on 8-year-old vulnerabilities and stolen credentials. “Instead of talking about ‘ripping and replacing’ we should be looking at why we aren’t patching or maintaining our critical infrastructure.”
A data center is a different prize from a carrier’s messaging service. Eric Hanselman of S&P Global Market Intelligence said access there would let the hackers watch traffic between services and applications that never crosses the open internet, and that traffic may be less well protected. Digital Realty runs more than 300 data centers in 25 countries; its clients include Amazon Web Services, Google Cloud, IBM, Microsoft and Nvidia. Comcast has about 51 million broadband and cable customers and about 8.1 million wireless customers.
Sen. Josh Hawley, R-Mo., told a Senate Homeland Security Committee hearing that the hackers are still inside. “What we were told is that foreign actors basically have unlimited access to our voice messages, to our telephone calls,” he said.
The Cyber Safety Review Board, a DHS body that was investigating the hacks, was dismissed at the start of the Trump administration, and lawmakers want it reinstated. Rep. Bennie Thompson, D-Miss., the top Democrat on the House Homeland Security Committee, warned that “doing more with less” would leave the country “unaware and unprepared.”
Sources
- US agencies assessed Chinese telecom hackers likely hit data center and residential internet providers
- Chinese hackers breach multiple US telecom firms | Digital Watch Observatory
