Washington — Federal authorities are urgently investigating a cyberattack linked to Chinese-backed hackers that targeted major U.S. telecommunications companies and systems used for key government intelligence-gathering capabilities, a U.S. official close to the government confirmed. file to CBS News.
The hacking group known as “Salt Typhoon” has attacked numerous companies, including Verizon, AT&T and Lumen Technologies. The official, who spoke on condition of anonymity, said the scale and severity of the hack were not yet clear.
According to the official, Chinese hackers breached systems used by U.S. intelligence services to conduct wiretapping, and affected government agencies and private companies are trying to determine what information, if any, the bad actors may have collected .
The hack was first reported by the Wall Street Journal. The FBI and other federal agencies, including the Cybersecurity and Infrastructure Security Agency, are currently investigating the cyber breach. The FBI, Department of Justice and CISA had no comment.
AT&T and Lumen Technologies declined to comment for this report. Verizon did not immediately respond to CBS News’ request for comment.
What did the hackers target?
U.S. intelligence officials routinely seek court permission to use telecommunications systems like those targeted in the attack to collect information for law enforcement or national security investigations. The U.S. official told CBS News that China-backed hackers had targeted U.S. surveillance capabilities used for operations such as wiretapping, and investigators are now trying to determine the extent to which the Chinese accessed the networks.
One fear is that the cyberattacks could have allowed hackers to access information about ongoing U.S. investigations – including those linked to China – through the collection of sensitive data and techniques.
What are American lawmakers saying?
In light of the reported hack, Sen. Ron Wyden, an Oregon Democrat, urged the Justice Department and the Federal Communications Commission to establish mandatory, uniform security standards for wiretapping systems telecommunications companies.
“The recently reported hacking of U.S. telecommunications companies’ wiretap systems should serve as a major wake-up call to the government,” Wyden said in a letter to FCC Chairman Jessica Rosenworcel and Attorney General Merrick Garland. “The Department of Justice’s outdated regulatory framework and ineffective approach to combating cyberattacks by protecting negligent companies must be addressed. The security of our nation’s communications infrastructure is paramount, and the government must act now to rectify these long-standing vulnerabilities. »
Specifically, Wyden called on the FCC to establish “baseline” cybersecurity standards for telecommunications companies, enforceable through fines, and to require, among other things, annual independent third-party cybersecurity audits.
He called on the Justice Department to hold “negligent” companies accountable and be transparent about data breaches with Congress, investigators and the public. He said the government should prioritize holding companies accountable for poor cybersecurity over prosecuting foreign hackers because such hackers are rarely successfully brought to justice.
What else has China done?
FBI Director Christopher Wray and other senior US officials have warned for a long time on cyber threats posed by China. The pirates supported by the Chinese government has recently targeted U.S. water treatment plants and power grids, strategically positioning itself within critical infrastructure systems to “wreak havoc and cause real harm to American citizens and communities,” Wray said to Congress in January.
Earlier this year, CISA officials issued a public advisory alleging that China-backed hackers “sought to preposition themselves on computer networks to launch disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a crisis or major conflict with the United States. States.”
And in recent years, federal Justice Department officials have warned of China’s attempts to steal sensitive technological information from the United States to bolster its own domestic capabilities.
A year-long cyber operation by a notorious Chinese state actor known as APT 41 siphoned billions of dollars of intellectual property from approximately 30 multinational companies in the pharmaceutical, energy and manufacturing sectors. CBS News reported in 2022. This included sensitive data from companies in North America, Europe and Asia.
Margaret Brennan,
and Nicole Sganga contributed to this report.
