Suspected Chinese actors compromise U.S. Telecom firm Ribbon Communications

Ribbon Communications, a U.S.-based technology company providing telecommunications and networking, employs approximately 3,052 people as of 31 December 2024 and reported annual revenue of US$834 million in 2024. The company disclosed a cyberattack likely carried out by a nation-state actor with a China nexus, with intrusion discovered in September 2025 but potentially dating back to December 2024.

Threat actors gained access to some customer files stored on two laptops, and several customer files saved outside the main network on those laptops appear to have been accessed, with affected customers being notified. The company states that it has not found evidence of material information exfiltration as of the date of the Form 10-Q filed with the SECURITIES AND EXCHANGE COMMISSION, and its incident response efforts included third-party cybersecurity experts and federal law enforcement.

The investigation is ongoing, and Ribbon expects additional costs but believes they will not be significant. According to the Form 10-Q, initial access may have occurred as early as December 2024, with final determinations pending further investigation.