The US Consumer Financial Protection Bureau (CFPB) has issued an emergency order barring employees and contractors from using cell phones to make work-related calls, following a major breach of US telecommunications infrastructure caused by Chinese-linked hackers.
According to an internal memo, the CFPB’s chief information officer advised employees to delete sensitive chats to protect platforms such as Microsoft Teams and Cisco WebEx, the Wall Street Journal (WSJ) reported.
The order follows the ‘Salt Typhoon’ attack on telecommunications infrastructure
The warning, prompted by fears of eavesdropping and data theft, follows what officials describe as a major espionage operation believed to be carried out by the Chinese-linked hacker group Salt Typhoon.
The group reportedly gained unauthorized access to major US telecommunications infrastructure, including data from Verizon and AT&T, putting the privacy of thousands of Americans at risk.
“DO NOT conduct CFPB work using voice calls or text messages,” the report cites the order, urging employees to refrain from using their personal and work-issued phones for any conversations involving sensitive or non-public information.
The CFPB’s chief information officer emphasized in an email that, while there is no indication that the CFPB itself was specifically targeted, the guidance is an effective measure to reduce risks.
“Although there is no evidence that the CFPB is the target of this unauthorized access, I am asking you to comply with these guidelines to minimize the risk of our being compromised,” an email sent to all CFPB employees and contractors read.
Access to data raises the alarm over espionage targets
Salt Typhoon’s hack reportedly gave them access to extensive data, including phone logs, text messages, and even audio recordings of high-level people connected to national security and political campaigns, including members of the Trump and Harris presidential campaigns, according to the WSJ.
“Salt Storm’s access to phone logs, unencrypted texts, and audio communications poses a significant threat to national security. Such data can reveal sensitive information about government operations, security strategies and intelligence operations,” said Arjun Chauhan, senior analyst at Everest Group. “For people in sensitive roles, these breaches threaten personal security, expose confidential communications, and increase the risk of coercion or arrest.”
While US agencies regularly remind employees of cybersecurity best practices, the clarification of the CFPB order reflects the government’s heightened concern about the nature and scope of these particular breaches.
“Many government officials, wary of this vulnerability, have already limited their use of their mobile phones,” the report quotes the former official, noting that the warning stems from the awareness that hackers can gain access to sensitive communications with senior officials and policy makers.
In September of this year, a similar threat actor, Salt Typhoon, was accused of hacking US ISPs with cyber espionage.
Federal cybersecurity is on high alert
The Cybersecurity and Infrastructure Security Agency (CISA), the federal body responsible for directing cyber security policy across US public organizations, has yet to issue an official response to the attack. However, the magnitude of the breach has prompted discussions to re-examine mobile communications policies within government agencies.
The question to CISA remains unanswered.
“In addition to restricting mobile device usage, agencies should use end-to-end encryption for all communications to prevent unauthorized access,” added Everest Group’s Chauhan. “Regular security audits and reviews of telecom infrastructure are essential to identify and remediate vulnerabilities. Training employees on how to be aware of phishing attempts and secure communication methods can further reduce risks.”
Apart from that, the establishment of incident response procedures ensures that it is acted upon quickly in the event of a breach, minimizing the potential damage,” noted Chauhan.
The CFPB order underscores the need for secure communications channels for the US government amid growing threats from foreign adversaries. The full extent of the breach and the details of any other organizations at risk are still being investigated, and government agencies, particularly those with national security, are expected to strengthen communications protocols to protect against similar threats.
As investigators continue to assess the impact of the Salt Storm attacks, the incident serves as a stark reminder of the importance of strong cyber security measures to protect sensitive information from sophisticated espionage efforts.
Source link