A huge hack of U.S. phone companies means your text messages may not be safe

At least eight U.S. telecom firms and dozens of countries have been impacted this week by what a top White House official called a Chinese hacking campaign that has also raised concerns about the security of text messaging.

At a media briefing Wednesday, U.S. deputy national security adviser Anne Neuberger shared details about the breadth of a sprawling hacking campaign that gave officials in Beijing access to private texts and phone conversations of an unknown number of Americans.

A group of hackers known as Salt Typhoon is being blamed for the attack targeting companies, which reportedly included AT&T, Verizon and Lumen Technologies. White House officials cautioned that the number of telecommunication firms and countries impacted could still grow.

Canadian cybersecurity experts paying close attention to this latest breach say some industry practices and government regulations that allow intelligence organizations access to the telecommunications system are part of the problem. These experts and U.S. law enforcement officials are recommending that people take action to protect their text messages.

"The attack that is unfolding in the United States is a reflection of historical and continuing vulnerabilities in telecommunication networks around the world, and some of those vulnerabilities are made worse by government," said Kate Robertson, a lawyer and senior researcher at the University of Toronto's Citizen Lab, which studies digital threats to civil society.

Though the hack apparently focused on American politicians and government officials, experts say regular SMS text messages, the kind most wireless carriers offer, aren't very secure because they're unencrypted.

"We are constantly bombarded with concerns about phishing and email scams and malicious links," said security consultant Andrew Kirsch, a former intelligence officer with the Canadian Security Intelligence Service (CSIS).

"This shines a light on the fact that the other vulnerability is through our telecommunications, phone calls and text messages."

Communications Security Establishment Canada (CSE), which provides the federal government with information technology security and foreign signals intelligence, said in a statement on Saturday that at this time, it "is not aware of any Canadian networks impacted by this activity."

The agency went on to say that the Canadian Centre for Cyber Security, which is part of the CSE, "works closely with Canadian government partners and critical infrastructure providers to help them protect their networks and systems from cyber threats."

Earlier this week, the Canadian Centre for Cyber Security issued a joint release with the U.S., Australia and New Zealand with security advice for companies like cellphone providers on "enhanced visibility and hardening for communications infrastructure."

CBC News also contacted Canada's largest cellphone providers — Bell, Rogers and Telus — to ask if their networks had been targeted and breached in the same attack. Rogers and Telus did not respond before publication.

Bell said it was aware of "a highly sophisticated" attack in the U.S. and was working with government partners and other telecommunications companies "to identify any potentially related security incidents across our networks."

The telecommunications company says it hasn't seen any evidence of an attack but continues "to investigate and maintain vigilance."