Ribbon Communications Breach Linked to Suspected Nation-State Cyberattack

Ribbon Communications hit by suspected nation-state cyberattack; U.S. probe finds limited data exposure, no gov systems hit.

Ribbon Communications Confirms Cyber Breach Linked to Suspected Nation-State Hackers

Texas-based telecom technology provider Ribbon Communications has disclosed a major cybersecurity breach believed to be the work of a nation-state-linked hacking group. The revelation came in the company’s October 23 filing with the U.S. Securities and Exchange Commission (SEC), detailing that unauthorized access to its network began in December 2024 and was detected only last month.

The company said the attackers infiltrated parts of its internal IT systems and accessed several customer-related files saved on two laptops outside its main network environment. So far, three smaller clients have been identified as affected, though Ribbon emphasized there is no evidence that core telecom systems or government clients were compromised.

Ribbon has not attributed the breach to any specific country, but cybersecurity analysts suggest the incident fits a growing trend of nation-state espionage targeting global telecommunications infrastructure. In 2024, Chinese-linked hackers were tied to the “Salt Typhoon” cyber campaign, which targeted telecom firms and U.S. defense networks.

In response to questions, China’s embassy in Washington denied any involvement, reiterating that the country “opposes hacking in all forms.” It also referenced Beijing’s own accusations that U.S.-linked groups had infiltrated Chinese systems. Meanwhile, U.S. officials continue to label China as the most persistent cyber threat to American government and private-sector networks.