The FBI has labeled a suspected Chinese cyber intrusion into a government surveillance system a “major incident” that poses risks to U.S. national security, according to a senior law enforcement official and a source with knowledge of the matter.
Subscribe to read this story ad-free
Get unlimited access to ad-free articles and exclusive content.
The hack compromised sensitive information related to domestic law enforcement, the sources said, and the FBI recently informed lawmakers about it.
The revelation suggested a significant U.S. counterintelligence failure amid repeated hacking operations by China-linked actors in recent years that have penetrated critical infrastructure and telecommunications firms, former officials said.
The FBI and the Cybersecurity and Infrastructure Security Agency declined to comment.
The declaration by the FBI of a major cyber incident was first reported by Politico.
Under federal data security laws, a cyber breach is declared a “major incident” only if it involves the compromise of personally identifiable information that could cause “demonstrable harm” to national security interests, foreign relations, the economy, civil liberties or the public health of Americans.”
The cyber intrusion appeared to use similar tactics and techniques employed by a Chinese hacking effort known as Salt Typhoon, which penetrated major telecommunications providers in an unprecedented breach, according to the source with knowledge of the matter.
The hackers in Salt Typhoon, which was uncovered in 2024, were able to obtain phone call records from millions of Americans and steal FBI wiretap data.
The Salt Typhoon hacking campaign was one of the largest intelligence compromises in American history. It breached eight domestic telecom and internet service providers and dozens of others around the world. U.S. officials said in 2024 that victims included people in both major parties’ presidential campaigns.
Under the 1994 Communications Assistance for Law Enforcement Act (CALEA), American telecoms are required to maintain systems to surveil unencrypted conversations when required by court order. Salt Typhoon accessed some CALEA systems in 2024, officials told NBC News.
China has denied responsibility for Salt Typhoon.
The breach of law enforcement data showed that Chinese-backed hackers were continuing to target the U.S. despite the global attention Salt Typhoon generated and attempts by the Trump administration to lower tensions ahead of President Donald Trump’s scheduled visit to Beijing next month, a former senior cybersecurity official said.
“Their hacking continues with impunity,” the former official said. “This shows they don’t feel deterred by the larger global exposure. … They’re bold.”
Sen. Mark Warner, D-Va., the vice chair of the Senate Intelligence Committee, said the episode illustrated the persistent threat posed by China and other sophisticated cyber adversaries.
“From Salt Typhoon to Stryker to now this reported breach at the FBI, the pattern is clear: our adversaries are probing for weaknesses, and they’re finding them,” Warner said in a statement.
He added that major cutbacks to cybersecurity staff across the government were putting the country’s digital defenses at risk.
“What makes this even more concerning is that, at the very moment these threats are escalating, this administration has been systematically hollowing out the very cyber expertise we rely on to defend the country, pushing out experienced professionals at the FBI and at Cybersecurity and Infrastructure Security Agency,” he said.
The former cybersecurity official said U.S. adversaries are keenly aware that major reductions in the federal workforce provide a valuable opportunity to probe computer networks.
“They’ve got awareness at this point that the federal government is fairly hollowed out. If you’re an adversary thinking about intelligence collection, this is certainly a time to take advantage of this opportunity,” the former official said.
Cynthia Kaiser, who left a role as a senior official in the FBI’s cyber division in May, told NBC News that while China had been targeting American communications for several years, this intrusion was discovered after she left the agency.
“China is consistently targeting any information that can help them identify and track their own targets, communication and movements around the world. And intelligence community, FBI and law enforcement intercepts would absolutely help them meet these goals,” she said.
