By Kimberly Hayek
A nation-state hacker infiltrated Ribbon Communications’ networks and lurked undetected for nearly a year, a company spokesperson confirmed Wednesday.
The Texas-based firm, which supplies technology for voice and data links across platforms, disclosed in its quarterly report filed with the U.S. Securities and Exchange Commission (SEC) on Oct. 23 that it discovered the breach in early September. The hackers tied to a foreign government first slipped in around December 2024.
The filing did not identify the hacker or the nation involved.
The company said the breach caused fluctuations in revenue, supply chain disruptions, and general cybersecurity threats.
Ribbon Communications provides technology for voice and data communication to telecom firms and governments. The filing does not clarify the extent of the damage done in the incident, though it does file the incident with material cybersecurity and data intrusion risks.
“While we do not have evidence at this time that would indicate the threat actor gained access to any material information, we continue to work with our third-party experts to confirm this,” a Ribbon spokesperson said in an emailed statement. “We have also taken steps to further harden our network to prevent any future incidents.”
The company reported to the SEC that “several customer files saved outside of the main network on two laptops do appear to have been accessed by the threat actor.” The spokesperson declined to elaborate on “customer files” but said there were a total of four “older files.” The spokesperson also confirmed that “small customers” were affected by the threat actor.
The incident takes place amid nation-state cyber threats to telecom infrastructure, with governments regularly issuing advisories highlighting ongoing attacks on mission-critical networks. Federal guidelines require timely reporting of material incidents.
Federal authorities have highlighted groups such as Salt Typhoon, which has compromised U.S. telecom providers and was sanctioned by the Treasury Department in January.
In the Salt Typhoon incident, foreign actors sponsored by China compromised at least eight U.S. communications companies, accessing sensitive applications, as part of a global espionage campaign, the Federal Communications Commission (FCC) said at the time.
“Telecommunications networks are critical to the nation’s defense, public safety, and economic systems,” reads a fact sheet on the incident by the FCC. “While the Commission’s counterparts in the intelligence community are determining the scope and impact of the Salt Typhoon attack, the FCC can act now to strengthen cybersecurity safeguards and ensure resilience against future cyberattacks by adversaries.”
Nation-state cyberattacks on infrastructure such as telecommunications threaten vulnerabilities in supply chains and economic dislocation, according to a study published by Eastern Kentucky University in 2024.
Among Ribbon’s client base are Verizon, CenturyLink, Deutsche Telekom, SoftBank Group, TalkTalk, and Tata, according to the company’s website, as well as the U.S. War Department, the University of Texas at Austin, the City of Los Angeles, and the Los Angeles Public Library.
The company says it is conducting risk management, such as monitoring for third-party compromises.
“Today, America’s enemies need not attack our government to have a substantive national strategic effect,” retired U.S. Army Gen. Keith B. Alexander, former associate counsel to President George W. Bush, Jamil N. Jaffer, and Jennifer S. Brunet, former U.S. Air Force defense analyst, wrote for George Mason University in a 2017 report.
“Indeed, in some ways, attacking the U.S. civilian or economic infrastructure may be a more effective approach in the modern era, particularly for asymmetric actors or nation-state proxies.”
Reuters contributed to this report.
