LightBasin UNC1945, Simjacker, Pegasus spyware, Salt Typhoon wiretap breaches.
Within hours of Britain's declaration of war (11 p.m., 4 August 1914), the GPO cable ship CS Alert grappled and cut Germany's telegraph cables in the English Channel, forcing German traffic onto radio and neutral routes that Britain could intercept. Many accounts wrongly credit CS Telconia.
The British GPO cable ship CS Alert severed Germany's direct transatlantic subsea cables at the outbreak of WWI, forcing German diplomatic messages onto neutral cables transiting British landing stations where Room 40 intercepted the Zimmermann Telegram.
On 29 October 1975, NSA Director Lew Allen publicly confirmed to the Church Committee that, from 1945 to May 1975, the major US international telegraph carriers secretly passed copies of international telegrams to the NSA without warrants (SHAMROCK). Watch lists including US citizens were run against this traffic (MINARET).
Astronomer Clifford Stoll traced a 75-cent accounting error at Lawrence Berkeley Lab to a hacker in Hannover, Germany using international X.25 network gateways to spy for the Soviet KGB.
On 12 August 1988, Duncan Campbell's New Statesman article "Somebody's Listening" (headlined inside as "They've got it taped") was the first press report to name ECHELON. It described an NSA-run global system, identified as Project P415, to monitor civilian communications, drawing on disclosures by Lockheed engineer Margaret Newsham about RAF Menwith Hill.
Tsutomu Shimomura and the FBI tracked and arrested Kevin Mitnick in Raleigh, North Carolina using direction-finding antennas and cellular switchboard real-time ESN/MIN location triggers.
Rogue software patches in Vodafone Greece's Ericsson AXE-10 switches activated dormant Lawful Interception capability to wiretap the Greek Prime Minister and 100+ senior officials during the 2004 Athens Olympics period.
In 2006 retired AT&T technician Mark Klein filed a sworn declaration and internal documents in EFF's Hepting v. AT&T lawsuit (filed 31 January 2006) describing a secret NSA-controlled room, 641A, at AT&T's San Francisco facility that received a copy of AT&T's internet backbone traffic.
An intruder breached Dutch certificate authority DigiNotar in 2011 and issued 531 fraudulent certificates for 344 domains, including *.google.com, which was then used in a man-in-the-middle attack on roughly 300,000 users — more than 99% of them in Iran — according to Fox-IT's "Operation Black Tulip" investigation.
In September 2011 the Wall Street Journal reported that the FBI had located fraud suspect Daniel Rigmaiden with a "StingRay" cell-site simulator, and his court challenge became the first U.S. case to test the device; EPIC's 2012 FOIA suit then forced release of FBI StingRay records (2012–2013), and ACLU public-records work (2014–2015) showed widespread, often warrantless state and local use.
British intelligence agency GCHQ compromised Belgian telecom provider Belgacom (Proximus) using Quantum Insert packet injection to intercept European Union and NATO mobile data roaming sessions.
Symantec and Kaspersky exposed Regin, an extraordinarily sophisticated nation-state malware platform specifically engineered to infiltrate GSM cellular base station controllers and telecom routing cores.
On 17 December 2015 Juniper disclosed "unauthorized code" in ScreenOS: an administrative authentication backdoor (CVE-2015-7755) and a change enabling passive decryption of VPN traffic (CVE-2015-7756).
On 19 February 2015 The Intercept, citing Snowden documents, reported that a joint NSA–GCHQ team had penetrated Gemalto, the world's largest SIM maker, to steal the Ki keys used to secure mobile communications; Gemalto said a 2010–2011 operation "probably happened" but denied massive key theft.
Cybereason revealed Operation Soft Cell, a massive multi-year cyber espionage campaign by suspected nation-state actors that completely compromised multiple telecommunications providers to exfiltrate raw subscriber Call Detail Records.
CrowdStrike revealed that the LightBasin (UNC1945) APT had compromised 13+ global telecom operators since at least 2016 using custom GTP and SS7 tooling to masquerade as roaming infrastructure.
AdaptiveMobile Security disclosed Simjacker, an exploit abusing legacy S@T Browser technology on SIM cards across 30+ countries to track subscriber location without user awareness.
A global consortium of journalists revealed that NSO Group's Pegasus spyware had targeted 50,000+ phone numbers across 50 countries, utilizing zero-click SMS/iMessage parser vulnerabilities.
On 12 December 2023 a destructive cyberattack disabled mobile and home-internet service for roughly 24 million Kyivstar subscribers for days; Ukraine's SBU attributed it to Russian military intelligence's Sandworm group.
On 24 May 2023 Microsoft and a joint NSA/CISA/FBI and Five Eyes advisory (AA23-144A) exposed Volt Typhoon, a China state-sponsored actor targeting communications and other critical infrastructure in Guam and the United States since mid-2021.
On 19 November 2024, alongside Adam Meyers' testimony to the US Senate Judiciary Committee, CrowdStrike named LIMINAL PANDA, an actor targeting telecom providers in South Asia and Africa since at least 2020, and reassigned some activity previously attributed to LightBasin to it.
Chinese APT group Salt Typhoon breached the core networks of major US telecom providers — AT&T, Verizon, Lumen and others — reaching CALEA lawful-intercept systems and sustained metadata and audio collection across at least nine carriers.