Telcos are an attractive target for cybersecurity threat actors looking to further geopolitical, hacktivist, commercial, or even personal, aims. While they are typically well-defended, attackers do get through. What happens when they do?
AI developments and the threat environment are converging
No telco is immune to cybercrime, no matter how well protected it is. Telcos are an attractive target for hackers and depend on other sectors that are also vulnerable to attack (e.g., cloud and software-as-a-service providers). Artificial intelligence increases risks even further: IBM reported a more than 56% increase in AI-related security incidents year-on-year in 2026.
In 2026 alone, 21 telcos disclosed cybersecurity breaches. However, the number of cyberattacks could be higher given the typical time lags between hacker entry points and incident detection, and again between investigation and public reporting. For example, all four Singaporean telcos found malware infections in July 2025, but regulators and the telcos only disclosed this publicly in February 2026. This was due to suspicions of foreign espionage and their desire to catch and contain threat actors, without alerting them in advance.
Needless to say, the risk of a cyberattack on a telco is growing. And the impact of such attacks can linger long after an attacker has been expelled and systems rebuilt or made safe again. A survey of 1,800 IT professionals put operational recovery at 7.3 months in 2024, but effects on brand, for example, can take longer to bounce back.
IBM’s Cost of a Data Breach Report 2026 estimates the global average cost of a data breach at USD5 million, but this varies considerably by country (in the US, the average cost is more than twice this amount).
This report is based on extensive desk research, due to telco reticence to speak openly about the impacts of cyberattacks on their organisation and the consequences for their businesses. This is largely for legal reasons. The report considers the cases of four telcos, listed below, that have suffered cyberattacks recently.
Telco cyberattacks covered in the report
Source: STL Partners
In each instance, we look at what happened, how the breach was handled, its impact on customers, operational effects and financial outcomes for the telco, and reputational damage and churn. We also isolate learnings for telcos as they consider their own cybersecurity resilience.
Table of contents
- Executive Summary
- Introduction
- AT&T, US (Two breaches)
- Telco response
- Breach consequences
- Summary
- SK Telecom, South Korea
- Telco response
- Breach consequences
- Summary
- Colt Technology Services, UK
- Telco response
- Breach consequences
- Summary
- Odido, Netherlands
- Telco response
- Breach consequences
- Summary
- Conclusions
Author
Nicola Warren
Senior Analyst
Nicola Warren is a senior analyst, leading the Transformation Leadership research service at STL Partners.
