The US confirms that Chinese-backed hackers breached telecom providers to steal wiretap data

The U.S. government has confirmed that hackers with ties to China hacked multiple U.S. telecommunications service providers to gain access to the listening systems used by law enforcement to surveil Americans.

In one joint statement Published Monday, CISA and the FBI said they had uncovered “a broad and significant” cyberespionage campaign in which PRC-affiliated actors compromised networks at “multiple telecommunications companies” in the United States.

CISA and the FBI did not name the breached organizations, but AT&T, Lumen (formerly CenturyLink) and Verizon are among the telecom providers whose networks were breached, according to The Wall Street Journal.

The WSJ reported that Chinese hackers had access to the networks for “months or longer,” allowing them to “harvest Internet traffic from Internet service providers that count large and small businesses, and millions of Americans, as their customers.”

US government agencies confirmed on Monday that the breaches enabled “the theft of customer phone call data” and “the compromise of private communications of a limited number of individuals.”

The agencies did not name the targeted individuals but said they are “primarily involved in government or political activities.” Reports said last month that hackers linked to China had targeted the phones of then-presidential candidate Donald Trump and his running mate, Sen. J.D. Vance.

The PRC hacking campaign also exposed the China-linked hackers – known as “Salt typhoon” – to “copy certain information that was subject to U.S. law enforcement requests pursuant to court orders,” the statement said.

Previously the FBI and CISA said they were investigating breaches by a Chinese-backed hacking group at several telecommunications providers, but had not said whether data had been stolen or whether the hackers had gained access to the systems used to fulfill legal wiretapping requests.

“The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) continue to provide technical assistance, quickly share information to help other potential victims, and work to strengthen cyber defenses in the commercial communications sector,” the agencies said . . “We encourage any organization that believes it may be a victim to contact its local FBI Field Office or CISA.”