Chinese Spies Hit More Than 80 Countries in ‘Salt Typhoon’ Breach, FBI Reveals

The campaign also touched some 600 companies, and went beyond conventional espionage, an FBI official says.

A Beijing-linked yearslong espionage campaign that hit U.S. telecom companies and swept up Donald Trump’s phone calls actually targeted more than 80 countries, reaching across the globe to a far greater extent than investigators initially understood.

A person passes by the FBI seal on the wall of the FBI headquarters, in Washington, U.S., February 3 (REUTERS)

The scope of the intrusion allowed Chinese intelligence officers to potentially surveil U.S. citizens’ private communications and track their movements around the globe, Brett Leatherman, the FBI’s top cyber official, said in an interview. The agency estimates that the intruders likely obtained more than one million call records and targeted the telephone calls and text messages of more than 100 Americans.

“This is one of the more consequential cyber espionage breaches we have seen here in the United States,” he said.

The hackers were also able to access information from systems the federal government uses for court-authorized network wiretapping requests, one of the aspects of the breach that most concerned U.S. officials. “It should really set off alarm bells for all Americans,” Leatherman said.

The “Salt Typhoon” campaign dates back to at least 2019 but was only discovered by U.S. authorities last year. It allowed China-linked actors to access U.S. customer call data, private communications for a limited number of individuals, sensitive law-enforcement information and technical network information that could inform future attacks, The Wall Street Journal reported last year.

“If you are able to exfiltrate similar information globally you can start to aggregate that data and start to understand a much different intelligence picture than what you would get if you just targeted and compromised one country,” Leatherman said.

Networks run by major U.S. wireless carriers were among those breached, the Journal previously reported.

Verizon Communications said earlier this year that a “nation-state threat actor” had accessed its network as part of a broader attack and that it had contained the incident. AT&T said late last year that “the People’s Republic of China targeted a small number of individuals of foreign intelligence interest” and that in the few instances in which information was impacted, it complied with its notification obligations.

T-Mobile US said late last year that it detected attempts to infiltrate its systems by bad actors. Its defenses “worked as designed to prevent any access to or exfiltration of customer or sensitive information,” a T-Mobile spokeswoman said in a statement.

The Federal Bureau of Investigation has notified roughly 600 companies that the espionage activity indicated some interest in them for reasons including their commercial relationships and network vulnerabilities. In some countries, there have been compromises of telecommunication networks to varying degrees, while in others, the degree of access is unclear.

U.S. officials last year described the breach as a damaging and well-executed espionage operation by Beijing. Investigators now believe the activity was broader and more indiscriminate than previously understood, and beyond what countries usually understand to be espionage, Leatherman said. The activity potentially allowed Chinese spies to use cellphone geolocation data to track Americans’ movements, including outside the country, he said.

“That global indiscriminate targeting really is something that is outside the norms of cyberspace operations,” Leatherman said.

Beijing has denied involvement in the campaign and accused U.S. spy agencies and cybersecurity firms of secretly collaborating to piece together false evidence to frame China. A spokesman for the Chinese embassy in Washington, Liu Pengyu, said the U.S. hadn’t produced “conclusive and reliable evidence” that Salt Typhoon was linked to the Chinese government.

“China firmly opposes and combats all forms of cyber attacks and cyber crime,” he said.

The FBI believes that the intruders are largely contained and that it is now better equipped to spot their activity. On Wednesday, it released a memo that provided new details of the Salt Typhoon intrusions, including technical information about the hackers designed to help companies find them in their networks. The document was signed by other U.S. agencies and intelligence and cybersecurity services in other countries, including the U.K., Canada, the Czech Republic, Finland and Poland.

The hackers got into networks by exploiting a range of known vulnerabilities in software and devices connected to the networks, including routers, the memo said.

Write to Aruna Viswanatha at aruna.viswanatha@wsj.com and Sarah Krouse at sarah.krouse@wsj.com