AT&T and Verizon have allegedly refused to provide information on their response to the 2024 Salt Typhoon attacks.

Maria Cantwell (D-Wash.), the ranking member of the Senate Committee on Commerce, Science, and Transportation, urged Committee Chairman Ted Cruz (R-Texas) to subpoena AT&T CEO John Stankey and Verizon CEO Dan Schulman, requesting their testimony regarding the carriers' handling of cyberattacks, claiming the carriers failed to respond for request for documentation “for months.”

“Both AT&T and Verizon have chosen not to cooperate, which raises serious questions about the extent to which Americans who use these networks remain exposed to unacceptable risk,” Cantwell wrote. “Since then, expert witnesses warned this committee about the ongoing security risks posed by Salt Typhoon, while reports indicate that Salt Typhoon hackers are likely still inside U.S. telecommunications networks and may have even breached email accounts used by congressional staff.”

Hackers with links to China intercepted calls from senior U.S. officials, including phones belonging to President-elect Donald Trump, Vice President-elect JD Vance, and Vice President Kamala Harris.

Both carriers, along with Lumen Technologies counted among Salt Typhoon’s victims, with the President Joe Biden-era Federal Communications Commission (FCC) forcing carriers to shore up their defenses. Just a year later, though, the move was scrapped with FCC Chairman Brendan Carr suggesting it “exceeded the agency’s authority.”

Cantwell claimed that carriers, including AT&T and Verizon, are not taking the necessary actions to protect customers, with the attack itself having “not been fully remediated from telecommunications networks.”

Cantwell wrote to both carriers requesting documents about their efforts to recover from the hack and anything on how they intend to prevent a similar breach from happening again. But no security assessments have been provided.

Cantwell even went as far as to claim Mandiant, a company hired by both AT&T and Verizon to conduct comprehensive network security assessments after the hack, failed to provide such information, “apparently at the direction of AT&T and Verizon.”

“If AT&T and Verizon are not going to provide Congress key documentation voluntarily, then I believe this committee must promptly convene a hearing with their CEOs so they can explain why Americans should have confidence in the security of their networks amid mounting evidence that the Salt Typhoon hackers remain active and undeterred,” Cantwell wrote. “The American public deserves transparency and certainty that our nation’s major telecommunications networks are not currently exposed to unacceptable risks. This oversight hearing would be an opportunity to provide precisely that.”

Beyond the fallout from those sizable attacks in 2024, the Chinese-linked threat actors resurfaced late last year, targeting congressional staff email accounts.

Emails belonging to staffers on powerful committees, including House intelligence, foreign affairs, and the armed services, as well as systems used by the House China committee, are thought to have been breached in December 2025.

Reports also suggested that two of the minds behind companies believed to be involved the state-sponsored attacks started out as Cisco Networking Academy trainees.

Qiu Daibing and Yu Yang went on to found companies that developed technologies and services for the Ministry of State Security and China's People's Liberation Army, providing systems used in the mass cybersecurity espionage campaign.