Bloomberg reporting reveals how T-Mobile's cybersecurity team detected and expelled Chinese state-backed hackers from its network in 2024, during a wider espionage campaign known as Salt Typhoon that hit numerous US telecoms and infrastructure firms. The hackers, working for the Chinese government, sought to harvest phone records and information on senior US officials, including presidential candidates at the time, making the intrusion part of a significant national security concern rather than an isolated corporate breach.

Unlike AT&T, Verizon, Viasat, Charter and Windstream, which were more extensively compromised, T-Mobile largely avoided a full-scale breach by spotting the intrusion early. After months of unsuccessful searching, staff traced unusual activity to a system linked to a router belonging to another, unnamed telecom firm. T-Mobile's cybersecurity chief, Jeff Simon, told Bloomberg that he and three colleagues travelled to a data centre in Bellevue, Washington, located the compromised equipment and physically cut the cable connecting it to the outside network to sever the hackers' access.