The big picture: Chinese cybercrime syndicate Salt Typhoon hacked into the networks of multiple US carriers and network service providers, leading to a major data breach affecting millions of people. A report now claims that the affected companies failed to notify their customers about the hack and don't intend to do so in the future.
According to NBC News, AT&T and Verizon, the two companies most affected by the data breach, have not only failed to disclose information about the hack to their customers, but there's "no indication" that they have any plans to notify them in the future. Following the publication of the report, both carriers are facing backlash from privacy groups for failing to inform customers about the incident and advising them about risk mitigation.
It is worth noting here that both carriers, along with the FBI, informed select users that their connections may have been intercepted by state-sponsored hackers. Some of those notified by the authorities include the presidential campaigns of Donald Trump and Kamala Harris, and the office of Senate Majority Leader Chuck Schumer.
However, the notifications were reportedly limited to those who were directly targeted by the hackers and not other victims who were also affected. Many customers and privacy groups are venting their frustrations at the two carriers for only informing so-called "high-value" customers about the breach while leaving out millions of regular citizens.
Alan Butler, the executive director and president of the nonprofit Electronic Privacy Information Center, told NBC that the carriers' "deficient practices" resulted in the hack, and that the companies ought to be notifying all customers about the breach, irrespective of whether only their metadata was accessed by the hackers or the actual content of their calls were also disclosed.
AT&T and Verizon both denied allegations of negligence. In a statement to NBC, an AT&T spokesperson said that the company will "continue to comply with our obligations to notify affected parties," although an unnamed source quoted by the outlet claimed that "only a very small number" of victims have actually been notified. Another source told NBC that Verizon also only reached out to "a small number" of affected customers.
According to US officials, Chinese state-sponsored hackers Salt Typhoon accessed sensitive information of more than a million people, mostly in the Washington, D.C., area. This includes metadata about phone calls and texts: who the victims spoke to, when those calls happened, and even their location.