- US federal agency issues warning against cellphone usage for work calls
- Warning comes in the aftermath of the breach of several US telecoms providers
- Attack has been attributed to Salt Typhoon, who also breached a number of ISPs
The Consumer Financial Protection Bureau (CFPB) has issued a warning to its workers that personal mobile devices should not be used for sensitive work calls due to the recent Chinese probing of US telecommunications networks.
The email sent by the CFPB acknowledges that “While there is no evidence that CFPB has been targeted by this unauthorized access, I ask for your compliance with these directives so we reduce the risk that we will be compromised.”
The warning also extends to contractors working for the CFB, and highlights the scale of the attack against US telecoms by the China-related group tracked as Salt Typhoon.
Telecoms attack worries federal agencies
There is no indication on exactly what data may have been exfiltrated from the telecoms providers, but initial reports suggest that call logs, unencrypted texts and some phone audio was exfiltrated by the attackers, including audio from a number of high-profile individuals related to the Harris and Trump campaigns alongside potentially hundreds of thousands of US citizens.
US officials are also cutting down on their phone use in response to the hack, with a former US official who spoke to the Wall Street Journal (WSJ) stating, “There is a general reticence to use their cellphones.”
Salt Typhoon also managed to breach several internet service providers (ISP) in early October, including Verizon, AT&T, and Lumen, with the attackers also gaining access to a lawful wiretap used for surveillance by US authorities.
As the WSJ notes, a federal agency issuing a specific warning against the use of personal mobile phones indicates the depth and breadth of the attacks.
“Do NOT conduct CFPB work using mobile voice calls or text messages,” the CFPB email recommended. The email also stated that staff should only use authorized online collaboration platforms such as Cisco WebEx and Microsoft Teams to make calls and send messages that contain non-public data.
