Telecoms Cyber Statistics: Sourced Figures on Outages, SIM Swaps and Espionage

Telecoms operators sit underneath every other sector's security, yet the figures quoted about carrier attacks are often unsourced or borrowed from unrelated industries. This page brings together traceable telecoms cyber statistics from primary publishers: the ENISA Telecom Security Incidents 2024 report, the FBI Internet Crime Complaint Center (IC3) annual reports for 2024 and 2025, the Cifas analysis of SIM swap and mobile account takeover in the UK, the joint advisory AA25-239A on PRC state-sponsored intrusions into telecommunications backbones, the Verizon 2026 Data Breach Investigations Report (DBIR) Information sector snapshot and the Cloudflare DDoS threat report for Q3 2025. Each figure carries its publisher, report and period. It is written for carrier CISOs, fraud and network security teams, regulators and enterprise buyers of telecoms services who need defensible numbers. For who the attackers are and how they operate, read the Telecoms Threat Actors Guide; this page covers only the numbers and what they mean. Last reviewed: November 2026.

Source note: every figure below is quoted from the named publisher's own report or statement, as checked in November 2026; figures from a single publisher are labelled with that publisher. Confirm against the official text before relying on it.

Key takeaways

• Reported outages are rising. ENISA counted 188 significant telecom security incidents reported by national authorities for 2024, up 20.5% from 156 in 2023.
• SIM swap fraud is changing shape, not disappearing. US complaints to the FBI IC3 fell slightly to 971 in 2025 with losses of about USD 17.4 million, while UK filings of unauthorised SIM swaps to the Cifas National Fraud Database rose 1,055% in 2024 to nearly 3,000 cases.
• Mobile accounts are the main takeover target. Cifas reports that 48% of UK account takeover cases in 2024 involved mobile phone accounts, with unauthorised mobile upgrades up 96%.
• State espionage against carriers is global. Advisory AA25-239A, co-sealed by 23 agencies from 13 countries, ties PRC-linked intrusions to five exploited CVEs in edge and network devices, and the FBI has said the campaign reached more than 200 companies in 80 countries.
• Carriers are a top DDoS target. Cloudflare ranked telecommunications the second most attacked industry in Q3 2025, a quarter in which it mitigated about 8.3 million DDoS attacks.

Headline statistics

Statistics by theme

Outages and reported security incidents

• Incident volume: ENISA's Telecom Security Incidents 2024 report, published 15 July 2025, aggregates mandatory incident reports from national authorities in 26 EU Member States and 2 EFTA countries. It counts 188 incidents for 2024 against 156 for 2023 (when 26 Member States and 1 EFTA country reported), an increase of 20.5%.
• Impact: ENISA describes a significant drop in total user hours lost in 2024 compared with 2022 and 2023, so more incidents were reported but their combined impact on users fell. The report covers all causes of significant outages, including system failures, human error, natural phenomena and malicious actions, not only cyber attacks.
• What the reports measure: under the European Electronic Communications Code and now NIS2, providers report incidents with significant impact on networks or services. The count reflects national thresholds and reporting discipline as well as attacks, so year-on-year change is partly a reporting effect.

SIM swap and mobile account takeover

• US trend: IC3 SIM swap losses fell by roughly two thirds between 2023 and 2025 while complaint counts fell only about 10%. Average reported loss per complaint dropped from about USD 45,000 in 2023 to about USD 18,000 in 2025 (calculated from the IC3 figures). Over the same period the FCC adopted rules (published in the Federal Register on 8 December 2023) requiring secure authentication before SIM changes and port-outs, advance customer notification and free account locks; some provisions were delayed pending Paperwork Reduction Act review, so the link to the fall in losses is not established. IC3 counts only complaints filed, so real volumes are higher.
• UK surge: Cifas reported on 7 May 2025 that unauthorised SIM swap filings to the National Fraud Database rose 1,055% in 2024, to nearly 3,000 cases. Facility takeover rose 76%, with telecoms and online retail the most affected sectors, and identity fraud linked to mobile products rose 87%, more than 16,000 cases.
• Who is hit: Cifas found 48% of account takeover cases involved mobile phone accounts, unauthorised mobile upgrades up 96%, and consumers aged 61 and over making up 29% of account takeover cases, with filings about that group up 90% year on year.
• Why it matters beyond carriers: a swapped SIM defeats SMS one-time codes for banks, email and cloud consoles. ATT&CK for Mobile tracks this as T1451 SIM Card Swap. See the SIM Swap Fraud Guide.

Nation state intrusions into carriers

• Scale: joint Cybersecurity Advisory AA25-239A, first published 27 August 2025 and updated 3 September 2025, was co-authored and co-sealed by 23 agencies from 13 countries. It describes PRC state-sponsored activity observed since at least 2021 against telecommunications, government, transportation, lodging and military infrastructure networks, with indicators spanning August 2021 to June 2025. An FBI spokesperson told NBC News the campaign had reached more than 200 companies across 80 countries.
• Exploited vulnerabilities: the advisory lists five CVEs used for access to edge and network devices: CVE-2024-21887 (Ivanti Connect Secure), CVE-2024-3400 (Palo Alto Networks PAN-OS GlobalProtect), CVE-2023-20198 and CVE-2023-20273 (Cisco IOS XE web UI) and CVE-2018-0171 (Cisco Smart Install). All five had been public for more than a year when the advisory was published.
• Credentials over exploits: Cisco Talos, in its analysis summarised on our breach page, looked at the US telecom intrusions in February 2025 and found that in all but one case it investigated the actor got in with legitimate login credentials, and in one case kept access for more than three years. See the Salt Typhoon Telecom Intrusions 2025 breach page.
• What was taken: the FBI and CISA joint statement on PRC targeting of commercial telecommunications reported theft of customer call records, compromise of the private communications of a limited number of people mainly in government or politics, and copying of information subject to US law enforcement requests made under court orders.
• Subscriber data at scale: in July 2025 South Korea's Ministry of Science and ICT reported that a malware attack at SK Telecom leaked 26.96 million pieces of user data (Reuters, via Insurance Journal; single source), and ordered quarterly security measures and direct CEO oversight of data governance.

Breach patterns in the Information sector

• Read with care: the Verizon 2026 DBIR does not publish a telecommunications-only snapshot. Telecoms sits in Information (NAICS 51) with publishing, broadcasting and data processing, so the row above is the closest dataset, not a carrier figure.
• Insiders: the 11% internal actor share is higher than in most sector snapshots in the same report (Utilities 3%, Professional 3%), consistent with carrier fraud that relies on retail staff and care agents.

DDoS against carriers

• Ranking: Cloudflare's DDoS threat report for Q3 2025, published 3 December 2025, ranks Telecommunications the second most attacked industry after Information Technology and Services, in a quarter with about 8.3 million mitigated DDoS attacks, 15% more than Q2 and 40% more than a year earlier.
• Caveat: Cloudflare's figures come from its own network and customer base. They show relative targeting, not the share of all DDoS traffic carriers absorb on their own infrastructure. See the DDoS Attack Statistics page for cross-sector figures.

What the numbers mean for defenders

• Small versus large operators: an MVNO or regional ISP gets most from KEV-driven patching of its edge, per-user AAA on every router and firewall, and a documented SIM change authentication step agreed with its host network. A national carrier also needs a management-plane network separated from customer traffic, configuration baselining across thousands of devices, insider monitoring in retail and care channels, and lawful intercept systems treated as crown jewels. See the Telecom Network Security Guide.
• Where identity fits: network devices carry non-human credentials, such as SNMP community strings, TACACS+ shared secrets, local admin accounts and SSH keys, that are rarely rotated. The Talos findings show these, not zero-days, kept intruders inside. Subscriber identity is the other side: a SIM is an authenticator for the customer's whole digital life. See the Telecoms Identity Security Guide.
• Regulation drives some of the numbers: US SIM swap rules, the FCC CPNI breach rule and the UK Telecommunications (Security) Act shape what gets reported and when. See the FCC CPNI and Telecom Data Breach Rule Guide and the UK Telecommunications Security Act Guide.

How to turn these statistics into a programme:

1. Baseline your own figures: count internet-reachable management interfaces, open KEV entries on network devices, devices still using SNMPv1/v2c or shared local admin accounts, and monthly SIM change and port-out requests with their fraud rate.
2. Close the five advisory CVEs first: confirm none of the AA25-239A CVEs remain on any device, then check configurations against a known-good baseline for unexpected ACL changes, new local accounts, altered AAA server addresses and SSH on non-standard ports. Keep the pre-change configuration so any change can be rolled back.
3. Move network devices to per-user AAA: pilot TACACS+ with MFA on one region's devices, keep a break-glass local account in a vault, then rotate every SNMP string and shared key the old configurations exposed.
4. Harden SIM change and port-out: remove knowledge-based checks, add in-app or in-store verification, notify customers before processing, and offer locks free of charge; trial in one channel and compare fraud rates before full rollout.
5. Exercise outages from any cause: run a joint tabletop for a DDoS event, a configuration error and a state intrusion, including regulator notification timelines, and refresh this page's figures when each publisher releases a new edition.

Metrics that show the programme is working:

• Edge KEV exposure: open KEV-listed vulnerabilities on network and edge devices, target zero past the CISA due date.
• Credential hygiene on devices: share of devices using per-user AAA and SNMPv3, and age of the oldest shared secret.
• Configuration drift: unapproved configuration changes detected per month and median time to investigate.
• SIM swap fraud rate: confirmed fraudulent SIM changes and port-outs per 10,000 requests, by channel.
• DDoS resilience: minutes from attack detection to mitigation in the last exercise or event.

Common failure patterns when using telecoms statistics

• Treating ENISA's incident count as an attack count: the 188 incidents include system failures, human error and natural events. Use it for resilience arguments, not as a measure of cyber attacks alone.
• Quoting Information sector figures as carrier figures: the Verizon DBIR snapshot mixes telecoms with media and data processing. Say so whenever you use it.
• Reading falling IC3 losses as solved: US SIM swap losses fell, but complaints barely moved and UK filings rose more than tenfold. Fraud follows the weakest channel and country.
• Focusing on zero-days: the state intrusions relied on CVEs public for years and on stolen device credentials, as the Salt Typhoon Telecom Intrusions 2025 showed. Patch and credential hygiene matter more than exotic detection.
• Mixing denominators: IC3 counts complaints, Cifas counts member filings, Cloudflare ranks its own customers and ENISA counts regulator reports above national thresholds. They cannot be summed or compared directly.

Methodology notes and caveats

Practitioner checklist

• Quote each figure with publisher, report and period, and say whether it is complaints, filings, regulator reports or telemetry.
• Check every network and edge device against the five AA25-239A CVEs and the CISA KEV catalogue.
• Replace shared device credentials with per-user AAA, SNMPv3 and vaulted break-glass accounts.
• Baseline device configurations and alert on unapproved ACL, AAA, account and SSH changes.
• Remove knowledge-based checks from SIM change and port-out, and notify customers before processing.
• Measure SIM swap fraud per channel, including retail staff and care agents with account access.
• Test DDoS mitigation and failover at least yearly with the upstream provider.
• Plan for outages from any cause and rehearse regulator notification.
• Refresh this page's figures when ENISA, IC3, Cifas, Verizon or Cloudflare publish a new edition.

Standards and references

• ENISA: Telecom Security Incidents 2024
• FBI IC3: Internet Crime Report 2025
• FBI IC3: Internet Crime Report 2024
• FBI, CISA and partners: Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide (AA25-239A)
• CISA: Joint Statement from FBI and CISA on PRC Targeting of Commercial Telecommunications
• Federal Register: Protecting Consumers From SIM-Swap and Port-Out Fraud
• Cifas: 1,055% surge in unauthorised SIM swaps as mobile and telecoms sector hit hard
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Cloudflare: DDoS threat report for 2025 Q3
• NBC News: China used three private companies to hack global telecoms, U.S. says
• Insurance Journal (Reuters): SK Telecom data breach findings, July 2025

Related NHI Mgmt Group resources: Telecoms Threat Actors Guide, Telecom Network Security Guide, SIM Swap Fraud Guide, Salt Typhoon Threat Actor Profile, DDoS Attack Statistics.