For years, American officials have warned that China is waging a sweeping cyber offensive against the United States. Now, a New York Times investigation—citing U.S. intelligence sources—suggests that one of Beijing’s most ambitious campaigns, code-named Salt Typhoon, may have collected data on virtually every American.
The operation, officials say, targeted more than 80 countries and infiltrated some of the world’s most critical systems, from telecommunications to transportation. The result: an unprecedented ability for Chinese intelligence to monitor communications, track movements, and map global networks.
What is the Salt Typhoon cyberattack?
Salt Typhoon is described as a coordinated, years-long hacking campaign attributed to Chinese state-backed actors. According to WION’s reporting and the Times investigation, the campaign:
- Penetrated networks across government, military, lodging, transportation, and telecommunications sectors.
- Breached at least six U.S. telecom companies, exploiting long-unpatched vulnerabilities.
- Targeted international firms, including hotels like Marriott and even U.S. health insurers.
- Extended beyond the U.S., with Canada, Germany, Italy, Japan, Spain, and the U.K. also condemning Beijing’s role.
British and American officials have labeled the attack “indiscriminate” and “unrestrained,” with impacts far beyond the usual espionage playbook.
Who was targeted in Salt Typhoon?
The campaign’s scope was so broad that experts believe almost no American escaped surveillance. Cynthia Kaiser, a former FBI cyber division official, told the Times:
“I can’t imagine any American was spared given the breadth of the campaign.”
High-profile figures were reportedly singled out, including Donald Trump and JD Vance during their campaign days, as well as Democratic politicians. But ordinary citizens may also have been swept up—though it remains unclear whether that was intentional or incidental.
Unlike earlier Chinese hacks that focused on security personnel or government employees, Salt Typhoon cast a much wider net.
Why would China want data on ordinary Americans?
Analysts believe the goal goes beyond immediate intelligence gathering. Collecting massive datasets on millions of people allows long-term strategic advantages:
- Pattern mapping: Tracking movements, communications, and habits over years.
- Exploitation opportunities: Using stolen data to recruit, blackmail, or discredit individuals later.
- Strategic dominance: As cybersecurity expert Jamie MacColl explained, “If you’re a cyber power, then it makes sense you would want to compromise the global communications network.”
Anne Neuberger, the Biden administration’s deputy national security adviser for cyber issues, warned that Salt Typhoon reflects China’s effort to “dominate the digital battle space.”
Why Salt Typhoon marks a new era of cyberattacks
Earlier Chinese cyber intrusions, such as the 2015 breach of the U.S. Office of Personnel Management, were often blunt and relatively easy to detect. Salt Typhoon, by contrast, is:
- Sophisticated: Leveraging stealthy, long-term access to networks.
- Patient: Staying embedded for years to siphon off data gradually.
- Persistent: Coordinated across multiple sectors and nations simultaneously.
Jennifer Ewbank, former CIA deputy director for digital innovation, called Salt Typhoon a “new chapter” in Chinese cyber operations—far more advanced than what was seen a decade ago.
Who is behind Salt Typhoon?
Investigations have tied the campaign to at least three Chinese technology companies operating on behalf of the country’s military and intelligence agencies since 2019.
This reflects a broader Chinese model where commercial firms and state agencies collaborate closely, blurring the line between civilian and government cyber operations.
What damage could Salt Typhoon cause?
The breaches gave hackers potential access to sensitive communications, including the ability to:
- Intercept calls and texts: Senator Mark Warner, chair of the Senate Intelligence Committee, said the attackers could “listen in on telephone conversations and read unencrypted text messages.”
- Map networks: By infiltrating telecom carriers, hackers gained insights into the digital infrastructure of entire nations.
- Target allies: With global reach, Salt Typhoon compromised not just U.S. systems but those of partner countries.
The scale of the breach could allow Beijing to leverage the stolen information for decades.
How have Western governments responded?
While the U.S. and its allies—including Canada, Finland, Germany, Italy, Japan, Spain, and the U.K.—have condemned China’s involvement, concrete countermeasures remain unclear.
This ambiguity reflects the complexity of attributing cyberattacks at scale and the political difficulty of retaliating against a major power like China.
The bigger picture: U.S.–China cyber tensions
Salt Typhoon is only the latest chapter in a long-running cyber rivalry.
- In 2021, the Biden administration accused China of breaching Microsoft’s email systems.
- China has also been linked to attacks on power grids, defense contractors, and U.S. companies seeking intellectual property.
- Russia, too, continues its own state-sponsored hacking, adding another layer of challenge for Western cybersecurity defenses.
For the U.S., the revelation of Salt Typhoon underscores the urgent need to shore up outdated infrastructure that has made American systems such inviting targets.
Bottom line
Salt Typhoon isn’t just another data breach—it’s a signal that China has the capacity and patience to run decade-long cyber offensives against its rivals. By targeting not just officials but potentially everyday Americans, the campaign represents a shift toward total information dominance.
As former officials warn, the fallout may last for years, with China holding a vast digital archive of U.S. communications and movements. For Washington and its allies, the challenge is not just containing the damage but preventing the next Salt Typhoon.