Major telecom services provider Ribbon breached by state hackers

Ribbon Communications, a provider of telecommunications services to the U.S. government and telecom companies worldwide, revealed that nation-state hackers breached its IT network as early as December 2024.

Ribbon provides networking solutions and secure cloud communications services to telecommunications companies and critical infrastructure organizations worldwide.

The company has over 3,100 employees in 68 global offices, and its list of customers includes the City of Los Angeles, the Los Angeles Public Library, the University of Texas at Austin, government customers (such as the U.S. Department of Defense), and telecom providers like Verizon, CenturyLink, BT, Deutsche Telekom, Softbank, and TalkTalk.

As disclosed in a filing with the U.S. Securities and Exchange Commission (SEC) on October 23, Ribbon detected the breach in September 2025; however, evidence discovered so far indicates that the attackers first gained access to its systems in December 2024.

"In early September 2025, the Company became aware that unauthorized persons, reportedly associated with a nation-state actor, had gained access to the Company's IT network," Ribbon said.

"While the investigation is ongoing, the Company believes that it has been successful in terminating the unauthorized access by the threat actor. The Company has preliminarily determined that initial access by the threat actor may have occurred as early as December 2024, with final determinations dependent on completion of the ongoing investigation."

Ribbon is now working with third-party cybersecurity experts and federal law enforcement to investigate the breach and said that it has yet to find evidence that the threat attackers accessed or stole "any material information."

However, the company found that the attackers had gained access to files belonging to several customers, stored on two laptops outside of Ribbon's main network.

Although Ribbon expects to incur additional costs in the fourth quarter of 2025 related to the breach investigation and its network strengthening efforts, it does not currently anticipate these costs to be material.

While Ribbon has yet to attribute the cyberattack to a specific threat actor or hacking group, the breach bears resemblance to a series of widespread telecom breaches from last year that were linked to China's Salt Typhoon cyber-espionage group.

At the time, CISA and the FBI confirmed that the Chinese state hackers had breached multiple telecom providers (including AT&T, Verizon, Lumen, Consolidated Communications, Charter Communications, and Windstream), as well as other telecom firms in dozens of different countries.

Comcast and Digital Realty were also flagged in June as potentially compromised by the Salt Typhoon hacking group, with satellite communications company Viasat revealing weeks later that it had also been hacked as part of the same campaign.