T-Mobile physically cut a cable to evict Chinese hackers from its network

In 2024, T-Mobile’s cyber-defense team uncovered anomalous behavior on a system tied to a router belonging to an unnamed telecom partner. The activity was traced to Salt Typhoon, a hacking outfit supported by the Chinese government that had already breached dozens of carriers and data-center firms. After an extended hunt, Jeff Simon, T-Mobile’s chief of cybersecurity, along with three teammates, drove to the company’s Bellevue, Washington data centre, found the compromised box and used scissors to snip the cable linking it to external networks.

This physical disconnection stopped the attackers from accessing T-Mobile’s infrastructure, preventing a larger breach. The episode was first detailed by Bloomberg, which noted that other major providers such as AT&T, Verizon, Viasat, Charter and Windstream were also affected by the same campaign.