Salt Typhoon (telecom carrier espionage)

In autumn 2024, US authorities confirmed that a group attributed to Chinese intelligence, dubbed Salt Typhoon, had settled durably into the networks of several major US telecom carriers, at least nine according to the White House. The attackers accessed call metadata for very large numbers of subscribers, communications of political figures, and the systems through which carriers carry out court-ordered interception requests. In January 2025, the US Treasury sanctioned a Chinese cybersecurity company accused of taking part in the intrusions. The case is an espionage operation, not sabotage: no outage, no destruction. It nonetheless matters to insurance in several ways. It confirms that infrastructure operators are targets of state pre-positioning, able to move from observation to disruption. It raises the question of covering a long intrusion, discovered years after it began, under a claims-made policy. It illustrates victims' helplessness against a state attacker seeking no ransom, which strips the claim of its usual pattern. And it shows that war clauses are not the only issue: a peacetime espionage operation is not an act of war, but can be very costly to remediate.