U.S. telecommunications giant Ribbon has confirmed that government-backed hackers had access to its network for almost a year before getting caught, according to a public filing.
The telco giant said in a 10-Q disclosure last week with the U.S. Securities and Exchange Commission that a suspected “nation-state actor had gained access to the company’s IT network” as early as December 2024. Ribbon said it notified law enforcement and that it believes the hackers are no longer in its network.
The Texas-headquartered Ribbon provides phone, networking, and internet services for companies, enterprises, and critical infrastructure organizations, such as energy and transportation systems. The company counts hundreds of companies as customers, including Fortune 500 firms and government agencies, such as the Department of Defense.
Reuters first reported news of the breach.
Catherine Berthier, a spokesperson for Ribbon, confirmed that three of Ribbon’s customers are known to be affected but declined to name the affected companies, citing confidentiality.
It’s not clear if the hackers exfiltrated personally identifiable information belonging to any individuals or other sensitive data from its corporate customers in the breach, but the company noted in the filing that “several customer files saved outside of the main network on two laptops do appear to have been accessed by the threat actor.” Ribbon said it notified the affected customers.
Ribbon is the latest in a series of telecommunication providers to have been hacked over the past two years but did not immediately attribute the hack to a particular government, when asked by TechCrunch.
Berthier declined to provide additional information when asked by TechCrunch, citing the company’s ongoing investigation.
Chinese-backed hackers have previously targeted and compromised at least 200 U.S.-based companies, including phone and internet providers, in an effort to steal phone records and calling data about senior U.S. government officials. Several telcos, including AT&T, Verizon, and Lumen, were confirmed hacked as part of the campaign, along with cloud giants and datacenter providers.
Some of the companies were located outside of the United States, including in Canada.
The hackers, known as Salt Typhoon, are one of several China-backed hacking groups said to be targeting the U.S. and its allies as part of a multi-year effort to prepare for a future anticipated Chinese invasion of Taiwan, according to U.S. government officials.
Updated with comment from Ribbon.
