China Targets U.S. Government Phones in Major Cyber Attack

A federal agency has issued a directive to employees to reduce the use of their phones for work matters due to China’s recent hack of U.S. telecommunications infrastructure, according to people familiar with the matter.

In an email to staff sent Thursday, the chief information officer at the Consumer Financial Protection Bureau warned that internal and external work-related meetings and conversations that involve nonpublic data should only be held on platforms like Microsoft Teams and Cisco WebEx and not on work-issued or personal phones.

U.S. investigators believe hackers tied to a Chinese intelligence agency are responsible for the breaches and that they have targeted a wide array of senior national security and policy officials across the U.S. government in addition to politicians, the Journal has reported.

The Cybersecurity and Infrastructure Security Agency, which has the authority to issue cybersecurity directives across federal civilian agencies, didn’t respond to a request for comment.

“Do NOT conduct CFPB work using mobile voice calls or text messages,” the email said, while referencing a recent government statement acknowledging the telecommunications infrastructure attack. “While there is no evidence that CFPB has been targeted by this unauthorized access, I ask for your compliance with these directives so we reduce the risk that we will be compromised,” said the email, which was sent to all CFPB employees and contractors.It wasn’t clear if other federal agencies had taken similar measures or…   were planning to, but many U.S. officials have already curtailed their phone use due to the hack, according to a former official. “There is a general reticence to use their cellphones,” the former official said.U.S. agencies and many companies frequently send out cybersecurity tips and reminders to employees. But a directive to avoid cellphone use in response to a specific threat is rare for a government agency and reflects the level of concern among investigators about the severity of the breaches of telecommunications firms, including Verizon and AT&T. The alert added that staff shouldn’t place calls to a cellphone even if using a different communications platform, like Microsoft Teams.