• State-linked hackers stayed in Ribbon Communications’ network for nearly a year.
• Ribbon Communications says no sensitive or government systems were exposed.

Hackers linked to a foreign government slipped into systems at Ribbon Communications and stayed there for close to a year before anyone noticed, according to a statement the company gave to Reuters on Wednesday. The breach went undisclosed until now.

The Texas company helps carry voice and data traffic between different platforms and environments. In a 10-Q filing with the Securities and Exchange Commission on October 23, Ribbon said it learned early last month that attackers “reportedly associated with a nation-state actor” gained access to its IT network. The company believes the intrusion began in early December 2024.

Attacks on vendors that support global telecom operations have increased in recent years, raising concerns about long-term access to sensitive infrastructure by state-backed groups.

Ribbon did not name the country tied to the incident or share which customers were affected. The company told Reuters that it has found three “smaller customers” impacted so far.

“While we do not have evidence at this time that would indicate the threat actor gained access to any material information, we continue to work with our third-party experts to confirm this,” a spokesperson said in an email. “We have also taken steps to further harden our network to prevent any future incidents.”

In the SEC filing, Ribbon said that “several customer files saved outside of the main network on two laptops do appear to have been accessed by the threat actor.” The spokesperson declined to explain what those files contained, adding that there were four “older files” involved.

The company said it has not seen evidence that the hack provided access to customer systems and said it has no indication that government clients were affected.

Ribbon’s technology supports real-time voice and data communications, including connections between traditional phone calls and internet-based conferencing.

In the past, attackers tied to China have targeted telecom providers around the world. A campaign known as Salt Typhoon, disclosed in September 2024, involved years-long espionage across several companies and even touched the network of a US state’s Army National Guard.

More recently, Chinese hackers were found inside F5, a cybersecurity company whose products help organisations manage internet traffic.

When asked about the situation, Chinese embassy spokesperson Liu Pengyu told Reuters in an email that he was not aware of the case. He said cyber activity can be difficult to attribute and that “China opposes hacking and combats it in accordance with the law.” He also pointed to claims by Beijing that US hackers breached China’s National Time Service Center, calling the United States “the world’s No. 1 hacking state.”

A US embassy spokesperson in Beijing did not address those accusations directly at the time, instead describing China as “the most active and persistent cyber threat to US government, private-sector, and critical infrastructure networks.”

The FBI did not respond to a request for comment due to the ongoing federal government shutdown. A spokesperson for the Cybersecurity and Infrastructure Security Agency said the agency is aware of Ribbon’s disclosure and referred questions back to the company.

Ribbon’s public customer list includes telecom giants such as BT, Verizon, CenturyLink, Deutsche Telekom, SoftBank, TalkTalk, and Tata. Its website also highlights government clients including the U.S. Defense Department, the University of Texas at Austin, the City of Los Angeles, and the Los Angeles Public Library.

“Unit 42 continues to see advanced nation-state actors increasingly targeting networking and IT service companies that provide key services to government and critical infrastructure organisations,” said Pete Renals, director of national security programs at Palo Alto Networks. “In many cases, their primary goal is to establish long-term persistence within these networks to enable global espionage.”

Renals described Ribbon as a “prime example” because of its ties to US military customers and major telecom and energy companies across several countries.

“This central role as a supplier to sensitive government and infrastructure clients makes Ribbon a lucrative target for state-aligned actors, particularly from China and Russia,” he said.

Want to experience the full spectrum of enterprise technology innovation? Join TechEx in Amsterdam, California, and London. Covering AI, Big Data, Cyber Security, IoT, Digital Transformation, Intelligent Automation, Edge Computing, and Data Centres, TechEx brings together global leaders to share real-world use cases and in-depth insights. Click here for more information.

TechHQ is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.