Salt Typhoon: Why Your Phone Carrier Is a National Security Problem

In late 2024, news broke that a Chinese state-backed hacking group called Salt Typhoon had breached AT&T, Verizon, and T-Mobile. Not some sketchy third-party contractor. The actual carriers. The attackers got into the systems that store call records, text messages, and wiretap infrastructure used by law enforcement. This wasn’t a theoretical vulnerability someone found in a lab. It was a real breach that compromised real data belonging to real people.

The scope was bad. Salt Typhoon accessed detailed call records showing who called whom, when, and for how long. They got into the systems that handle legally authorized wiretaps, which means they could potentially see who US law enforcement was surveilling. Some reports indicated they accessed actual call and text content for targeted individuals, not just metadata. This is the kind of intelligence that nation-states spend billions trying to collect, and they got it by walking through the front door of America’s biggest carriers.

How they got in

The attack exploited the same legacy infrastructure that security researchers have been warning about for years. The big carriers still run on protocols like SS7 and Diameter that were designed decades ago, back when the telecom network was a closed system and the only people connecting to it were other phone companies. Those assumptions stopped being true a long time ago, but the infrastructure never caught up.

SS7 vulnerabilities have been publicly documented since at least 2014. Researchers have demonstrated live at security conferences how you can track someone’s location, intercept their calls, and read their texts using nothing but SS7 access. The carriers know about this. They’ve known for over a decade. The fix would require ripping out and replacing core infrastructure that their entire business runs on, so instead they’ve done the minimum possible and hoped for the best.

Salt Typhoon proved that “hoping for the best” is not a security strategy.

The political fallout

The breach was serious enough that it became a Congressional matter. Senator Ron Wyden publicly told his colleagues to stop using their regular carrier phones for sensitive communications. Think about that for a second. A sitting US Senator told other Senators that the phone service they’re using isn’t safe.

Cape’s CEO John Doyle testified before Congress about telecom security in the wake of the breach. His argument was straightforward: the big carriers can’t fix this problem because their infrastructure is the problem. You can’t patch a system that was never designed to be secure in the first place. You have to build something new.

Why Cape’s architecture is different

Cape runs a fully cloud-based core network with no legacy SS7 or Diameter infrastructure. That’s not a marketing distinction. It’s an architectural one. The attack surface that Salt Typhoon exploited simply doesn’t exist in Cape’s system because Cape never built those legacy systems to begin with.

Cape’s network lock feature blocks the specific types of signaling attacks that SS7 enables. Their IMSI rotation changes your network identifier every 24 hours, so even if someone did intercept a snapshot of network data, it wouldn’t be useful for long-term tracking. And their minimal data retention policy means there’s less to steal in the first place. Call logs get deleted after one day. Compare that to the carriers that were storing years of records that Salt Typhoon was able to access.

What this means for regular people

You might think a nation-state attack on telecom infrastructure doesn’t affect you personally. But the call records that were compromised belong to ordinary subscribers, not just government targets. If you were an AT&T or Verizon customer during the breach period, your call metadata was potentially exposed to a foreign intelligence service. You weren’t notified. You had no way to opt out.

The deeper issue is that these carriers are sitting on enormous databases of sensitive information about hundreds of millions of people, and they’ve proven they can’t protect it. Salt Typhoon won’t be the last group to try this. The next one might be better at covering their tracks.

If your carrier can’t protect your data from the people actively trying to steal it, the carrier is the problem. That’s not a privacy philosophy. It’s just a fact that played out in public in 2024.

Save $20/month with a referral code

If you want to try Cape, grab a free referral code at cape.rip before you sign up. It takes $20 off your monthly bill for as long as you stay subscribed, and the person who shared the code saves $20 too. No signup needed, no tracking. Just pick a code and use it at cape.co.