Salt Typhoon hack: Phone companies haven't informed affected customers, report says

Telecommunications giants AT&T and Verizon haven't addressed the full scope of victims of an ongoing Chinese phone data hacking campaign, according to a new NBC report.

In a media call last week, the FBI told the press that they have yet to fully evict Chinese state-sponsored hackers from U.S. networks and that the agency has spent the past months alerting "high-value intelligence targets" — including the campaigns of Donald Trump and Kamala Harris — to the extent of the hack, mainly those of interest to the U.S. government.

But the vast majority of the near-million people affected are most likely average Americans, and most of them have yet to be notified that they're victims. According to NBC, the telecom companies haven't clarified plans to notify customers, either.

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

SEE ALSO: 5 holiday scams that could wreck your season

The China-backed espionage campaign, labelled Salt Typhoon by Microsoft threat detectors, has utilized what is known as advanced persistent threat (APT) attacks to invade at least eight telecommunications companies for the purposes of exposing personal, individual communications. Recent investigations unearthed the years-long initiative involved the hacking of Americans' data in addition to the monitoring of political targets' communications. It's been called the "worst telecom hack in [U.S.] history by far," by Senate Intelligence Committee chairman Senator Mark R. Warner.

According to NBC, Salt Typhoon also accessed device metadata for non-intelligence targets mainly in the Washington D.C. area, which could have been used to track movements and personal communications although does not provide the content of said communications.

---

Related Stories

---

• AT&T, Ticketmaster data breach hackers charged with stealing 50 billion records
• Hackers are now sending scam QR codes via physical mail — and they can steal your passwords
• Internet Archive hacked again: We know because the hacker responded to our email to the Archive.
• Andrew Tate 'online university’ suffers breach: 800,000 users' data exposed
• Largest U.S. healthcare data breach exposes medical records of 100 million customers

The FCC mandates telecom companies notify customers only when its been established that customers have been or could be harmed by the breach. This includes "financial harm, physical harm, identity theft, theft of services, potential for blackmail, the disclosure of private facts, the disclosure of contact information for victims of abuse, and other similar types of dangers." But definitions and the scope of the breach's harm is up to the discretion of companies themselves.

So far, most of the affected telecom networks have remained tight-lipped over the breach. T-Mobile has alerted customers that an infiltration of their network happened, but have retained that hackers were evicted and no customer data was actually accessed.