My favorite security story of the summer involves no AI at all. It involves scissors.
New reporting from Bloomberg, summarized by TechCrunch, described how T-Mobile's security team dealt with the Salt Typhoon intrusions back in 2024 [1]. Salt Typhoon, a Chinese government-backed group, compromised hundreds of phone companies, internet providers and data center operators, going after phone records and information about senior U.S. officials. Named victims included AT&T, Verizon, Viasat, Charter and Windstream [1].
T-Mobile largely escaped a widescale breach by catching the activity early [1].
The scissors part
According to the reporting, T-Mobile's team spent months hunting for suspected intruders without success. Eventually they spotted unusual behavior on one of their systems coming from a router belonging to a different telecom company. The company's cybersecurity chief, Jeff Simon, told Bloomberg that he and three others drove to the nearby data center, found the compromised system, and snipped the cable connecting it to the outside world [1].
T-Mobile didn't comment to TechCrunch [1]. I'd have framed the scissors.
What I take from it
Know where your stuff is. You can only cut the right cable if you can find the right box. Asset inventory sounds boring right up until it's the difference between a 20-minute drive and a week of guessing.
Watch the edges between networks. The tell was traffic from another carrier's router [1]. Interconnects, partner links and vendor tunnels are where trust quietly piles up. They deserve monitoring as much as your front door.
Physical still beats logical, sometimes. When you're not sure what an attacker can still reach, unplugging is a perfectly valid containment step. Just document it, because someone will ask later why the thing is off.
Persistence wins hunts. Months of looking turned into one anomaly worth chasing. That's what good security teams actually do all day.
Telecom networks are some of the most complicated systems humans run. It's oddly comforting that, at the decisive moment, the fix was a short drive and a sharp tool.
Bonus lesson: write it down
The best part of this story is that people can tell it years later in detail. That only happens when someone keeps notes during the chaos: what was seen, what was cut, when, and why. Every incident team should have a designated note-taker. It feels like overhead in the moment and turns into gold during the review.
The takeaway for smaller shops
You don't need a telecom budget to learn from this. Keep a current network diagram, label your gear, and know who has the keys to every closet. The day you need to pull a plug fast is not the day to discover the rack is unlabeled.