The FBI and CISA issued a joint cybersecurity advisory on November 13, 2026, confirming that state-sponsored cyber threat actors affiliated with the People's Republic of China, Salt Typhoon, compromised multiple United States commercial telecommunications providers. Forensic investigations verified the threat actors exfiltrated customer call record metadata, compromised private communications of a limited number of individuals involved in government or political activities, and copied data subject to lawful United States law enforcement intercept requests authorized under judicial warrants.
According to technical threat actor profiles released by the National Cyber Joint Investigative Task Force, Salt Typhoon compromised perimeter routers and core transit switches operated by AT&T, Verizon, and Lumen Technologies. Exploiting unpatched edge firmware vulnerabilities and valid administrative credentials, the actors maintained covert unauthorized access for extended operational periods. They accessed internal systems carriers used to fulfill court-ordered wiretap requests under CALEA, and the breach exposed target surveillance directories and law enforcement collection telemetry.
The FCC announced administrative inquiries evaluating whether carriers satisfied statutory network security obligations under federal telecommunications law. It prepared regulatory proceedings requiring carriers to isolate CALEA intercept networks from external commercial data interfaces and mandate payload encryption, multi-factor authentication on administrative transit consoles, and continuous zero-trust monitoring across network backbones. Leaders of the Senate Select Committee on Intelligence requested classified briefings in a joint bipartisan statement, and lawmakers urged passage of the Telecommunications Cybersecurity and Resilience Act to authorize grant funding for removing vulnerable legacy core routing hardware from domestic backbones.
CISA distributed urgent technical advisories outlining mobile device operational security practices. The agency advised targeted personnel to route voice communications and text correspondence through verified end-to-end encrypted applications while scheduling daily smartphone reboots to eliminate non-persistent memory-resident malware payloads. Public sector employees were prohibited from utilizing unverified public Wi-Fi networks for official government communications.
