Telecommunications: the hidden risk in the digital supply chain

An attack on a telecommunications operator can compromise far more than connectivity. It can open the door to sensitive information, facilitate espionage, or affect the services on which thousands of organizations depend. In an interconnected economy, protecting critical assets requires looking beyond the corporate network itself.

When the target is the infrastructure that connects us

In February 2026, Singapore authorities disclosed a case that illustrates the strategic scale of this threat. The cyberespionage group UNC3886 had attacked the infrastructure of the country’s four main telecommunications operators: Singtel, StarHub, M1, and Simba Telecom.

The attackers managed to access parts of their systems and obtain a limited amount of technical information. According to the authorities, no service disruption or confirmed access to customers’ personal data was detected. However, the incident highlighted that telecommunications networks are high-value targets for actors capable of maintaining covert access to strategic infrastructure.

The case is not isolated in the threat landscape. In September 2026, the European incident response service CERT-EU reported a distributed denial-of-service (DDoS) attack against the Portuguese operator MEO, which caused service disruptions.

These are two different scenarios: one aimed at access and espionage, and the other at service disruption. Both show that telecommunications can become a direct target for cyberattackers, with consequences that extend beyond the systems initially compromised.

The domino effect of a supply chain attack

Telecommunications are an essential part of the digital supply chain. Industrial companies, financial institutions, public administrations, and critical infrastructure operators need these networks to communicate, exchange information, and access technology services.

When a connectivity provider suffers an incident, the impact can spread to its customers. An outage can hinder remote operations, block access to applications and systems hosted off-site, or prevent communication with suppliers and external platforms.

But the risk is not limited to a service outage.

If an attacker manages to compromise management systems, administrative credentials, or components of an operator’s infrastructure, they may also attempt to obtain technical information, maintain unauthorized access, or use that position to prepare further operations.

The European Commission and the Member States have already identified these scenarios in their assessment of the cybersecurity of European Union communications infrastructure. Some risks considered include supply chain attacks, network intrusions, ransomware, DDoS attacks, and the compromise of third-party providers.

The conclusion is relevant for any security leader: an organization’s risk surface does not end at its corporate perimeter. It also includes the technological dependencies it needs to operate.

How can an organization prepare?

It is not possible to guarantee that an operator will never suffer an attack or that a connection will remain available under all circumstances. The strategy should focus on reducing unnecessary dependencies, limiting the impact of incidents, and protecting the assets that remain the organization’s responsibility.

1. Identify critical dependencies. It is necessary to understand which processes require external connectivity, which services depend on a single provider, and what the consequences of losing each connection would be. This analysis should include remote access, cloud platforms, and communications between sites.

2. Design connectivity alternatives. When continuity requires it, having a secondary connection can reduce the impact of an outage. However, it is important to verify that routes and providers do not depend on the same physical or logical elements. Redundancy must be verified, not assumed.

3. Limit access to critical assets. User and supplier devices should not have direct, unrestricted access to sensitive systems. Segmenting environments, restricting privileges, and controlling sessions reduce the likelihood that a compromised device will become an entry point.

4. Strengthen traceability and response. Logging administrative sessions, reviewing privileged access, and having contingency procedures in place make it possible to detect anomalous behavior, investigate incidents, and respond more quickly.

These measures alone do not prevent an operator from suffering an attack. Their purpose is to prevent an external incident from also becoming an internal security breach.

Shielding access to critical assets

Telecommunications networks depend on a distributed infrastructure of IT and OT assets that must remain protected to ensure service continuity. Antennas, base stations, communications nodes, servers, management systems, and control platforms are essential components of an infrastructure whose disruption could affect thousands of users and businesses.

Protecting these assets is not only about defending them against direct attacks. It also requires controlling who can access them, from which devices, and under what conditions. Remote access by technicians, administrators, and external suppliers is operationally necessary, but it can also become a potential attack vector if a compromised device can directly reach critical systems.

This is where security architecture makes the difference.

At Cosmikal, we develop solutions that protect access to critical assets by isolating the working environment, controlling privileges, and restricting direct communication between user devices and protected systems.

In telecommunications infrastructure, this approach strengthens the protection of servers, network administration systems, nodes, and other IT and OT assets that require remote access for operation and maintenance. Instead of establishing a direct connection from the user’s device to the protected asset, interaction takes place through an isolated and controlled environment.

If an access device is compromised, the goal is to prevent that compromise from spreading to critical assets. Isolation reduces the exposure of these systems and limits the possibility that an attacker could use a user’s credentials or device as a route into the infrastructure.

It is important to distinguish between protecting access and ensuring network availability: Endurance does not by itself prevent a connectivity outage or replace redundancy and continuity measures. Its contribution is to reinforce a fundamental security barrier: preventing remote access from becoming an easy route to compromise the assets on which the service depends.

Technological sovereignty also means retaining control

Telecommunications security demonstrates that digital dependency is a strategic issue. Organizations need connectivity, but they must also retain the ability to decide how their systems are accessed, which permissions are granted, and which controls are applied to their critical assets.

For operators, protecting access to the infrastructure that supports communications is another measure for reducing the risk of incidents that could affect service delivery. Isolation, privilege management, and traceability help limit the possibility of unauthorized access and contain the impact of a compromised device.

For Cosmikal, technological sovereignty does not mean dispensing with external infrastructure, but rather retaining control over the security architecture and reducing dependencies that could compromise operations.

Because a resilient organization is not one that trusts its suppliers will never fail. It is one that understands its dependencies, protects its assets, and is prepared to limit the impact when something goes wrong.

Sources:

1. The Record — Singapore says China-linked hackers targeted telecom providers in major spying campaign

2. CERT-EU — Cyber Brief 26-10, September 2026

3. Report on the cybersecurity and resilience of EU communications networks

4. ENISA — Telecom Security Incidents 2024