Your Carrier Isn’t Protecting You

Your Carrier Isn’t Protecting You

The FCC Just Removed One of the Only Rules Forcing Telecoms to Strengthen Security

In January 2025, after the Chinese state-backed group Salt Typhoon breached at least eight U.S. telecom providers — including AT&T, Verizon, and T-Mobile — the FCC invoked Section 105 of CALEA to push carriers into urgently hardening their networks. The rule created accountability, penalties, and regulatory pressure for long-neglected security gaps.

Now the FCC has rescinded that ruling.

The agency says the original order was flawed, overly broad, and outside its authority. But removing it leaves millions of Americans exposed to the same weaknesses Salt Typhoon exploited — weaknesses the telecom industry has repeatedly failed to address voluntarily.

And for SMBs, healthcare organizations, law firms, and schools, this decision has real, immediate cybersecurity consequences.

What the FCC’s Reversal Actually Means

FCC Chair Brendan Carr announced that carriers had already agreed to strengthen their networks and accelerate patching — but acknowledged the January order was fundamentally “unlawful and ineffective.”

Repealing it means:

• No enforceable requirement for carriers to improve cybersecurity

• No penalties if they ignore vulnerabilities

• No regulatory mandate for threat hunting, segmentation, access control, or outbound connection restrictions

• No accountability for failures affecting hundreds of millions of Americans

This is especially concerning given carriers’ history:

• T-Mobile ignored SIM-swap threats for years

• AT&T, Verizon, and T-Mobile were fined for illegally sharing customer location data

• Multiple carriers have experienced supply-chain breaches, metadata theft, and insider abuse

The track record is not reassuring.

Why Customers Should Be Worried

Salt Typhoon didn’t just hack a few accounts.

They compromised core wireless infrastructure.

From inside the networks, attackers quietly collected:

• Account credentials

• Sensitive customer records

• Wireless metadata

• Location traces

• Over-the-air information most people assume is protected

They operated for months before detection — inside the systems the entire country relies on for communication.

And experts warn that Salt Typhoon’s campaigns are still active today.

The FCC’s rollback removes the only rule directly aimed at preventing this from happening again.

Why This Matters for SMBs, Healthcare, Law Firms, and Schools

Your organization relies on carrier networks for:

• MFA codes

• Email access

• Remote work

• VoIP calls

• Patient or client communication

• Critical alerts

• Cloud-service connectivity

If carriers fail to secure their infrastructure, your organization is exposed — even if your internal cybersecurity posture is strong.

When the network itself is compromised:

• SMS-based MFA can be intercepted

• Voicemail can be hijacked

• Metadata can be harvested

• Traffic analysis can map your operations

• Account recovery workflows can be manipulated

This is the kind of systemic risk that bypasses traditional defenses.

What You Should Do Right Now

1. Stop using SMS for MFA

Use:

• Authenticator apps

• Passkeys

• Hardware security keys

Telecom carriers cannot protect your authentication.

2. Encrypt everything

Use encrypted apps for sensitive communication — organizations must assume carrier networks are not trustworthy.

3. Enforce strong password management

A password manager greatly reduces the impact of metadata leaks and credential exposure.

4. Deploy VPN usage policies

A VPN won’t block a telecom breach, but it reduces metadata visibility and hardens traffic against passive collection.

5. Conduct incident-impact assessments

If Salt Typhoon had access to your carrier during the breach windows, assume exposure.

6. Reevaluate business continuity plans

Carrier outages, metadata leaks, and SIM-swap escalation must now be considered part of your organizational threat model.

Telecom security failures are not abstract.

When infrastructure falls, everyone falls with it.

70% of all cyber attacks target small businesses, I can help protect yours.

#cybersecurity #managedIT #MSP #dataprotection #SMBsecurity