INCIDENT REPORT · CP-2024-011

Salt Typhoon compromise of US telecommunications providers

L3 · ELEVATEDCONFIRMED

On 13 November 2024, the FBI and CISA said PRC-affiliated actors had compromised networks at multiple US telecommunications companies in a broad and significant cyber espionage campaign.

Incident ID: CP-2024-011
Disclosure date: 13 NOV 2024
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Washington, D.C., United States (National-level marker; multiple US telecom providers affected)
Threat classification: Level 3 — ELEVATED
Classification rationale: Significant espionage compromise of multiple major telecommunications providers; no demonstrated service disruption, so held at Level 3.
Attack type: Espionage
Nature: Malicious activity
Attack vector: Not publicly documented
Sectors: Telecommunications, Government
Critical infrastructure: Yes
Organizations affected: Multiple US telecommunications providers (nine per the White House, December 2024); AT&T, Verizon and Lumen were reported among them
Operational consequences: The actors stole customer call records, compromised communications of a limited number of people in government or political activity, and copied information subject to US law enforcement court-ordered requests. The White House later said nine telecoms were affected.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the FBI and CISA to actors affiliated with the People's Republic of China (tracked as Salt Typhoon)

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Salt Typhoon compromise of US telecommunications providers

L3 · ELEVATEDCONFIRMED

On 13 November 2024, the FBI and CISA said PRC-affiliated actors had compromised networks at multiple US telecommunications companies in a broad and significant cyber espionage campaign.

Incident ID

CP-2024-011

Disclosure date

13 NOV 2024

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Washington, D.C., United States (National-level marker; multiple US telecom providers affected)

Threat classification

Level 3 — ELEVATED

Classification rationale

Significant espionage compromise of multiple major telecommunications providers; no demonstrated service disruption, so held at Level 3.

Attack type

Espionage

Nature

Malicious activity

Attack vector

Not publicly documented

Sectors

Telecommunications, Government

Critical infrastructure

Yes

Organizations affected

Multiple US telecommunications providers (nine per the White House, December 2024); AT&T, Verizon and Lumen were reported among them

Operational consequences

The actors stole customer call records, compromised communications of a limited number of people in government or political activity, and copied information subject to US law enforcement court-ordered requests. The White House later said nine telecoms were affected.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the FBI and CISA to actors affiliated with the People's Republic of China (tracked as Salt Typhoon)