Cellcom

Summary

Cellcom experienced a cyber incident that disrupted voice and SMS services for customers in Wisconsin and Upper Michigan while data services, iMessage, RCS messaging, and 911 emergency services remained operational. The company engaged external cybersecurity experts, notified the FBI and Wisconsin officials, and stated there is no evidence that personal information was compromised, working to restore full service by the end of the week.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the evening of May 14, 2025, wireless customers of Cellcom in Wisconsin and Upper Michigan experienced a sudden loss of voice and short message service, leaving them unable to place calls or send texts. Cellcom initially characterized the disruption as a technical issue, noting that data services, iMessage, RCS messaging, and 911 emergency services continued to operate. As the outage persisted into the following days, subscribers reported growing frustration and difficulty porting their numbers to other carriers due to the affected platforms. In a letter dated May 14, 2025, Cellcom CEO Brighid Riordan acknowledged that the company had suffered a cyber incident, stating that existing response protocols had been activated, outside cybersecurity experts engaged, and the FBI and Wisconsin officials notified. She emphasized that the incident was confined to a portion of the network separate from where customer personal data is stored and that there was no evidence of compromised names, addresses, or financial information.

Throughout the outage, Cellcom teams worked around the clock to restore affected systems, and by May 19 the company reported that SMS text messaging and voice calls between Cellcom subscribers had been brought back online. Despite this progress, Cellcom could not provide a definitive timeline for full service restoration, indicating only that it aimed to have all services returned by the end of the week. The CEO also shared a video message to subscribers explaining the situation and the ongoing recovery efforts. When BleepingComputer reached out to Cellcom for clarification on whether the incident involved ransomware or another type of cyber attack, the company did not reply to the inquiry. Cellcom stated that it would compensate customers for the time they were without service, acknowledging the inconvenience and hardship caused by the disruption.

Sources

Sources available to members: 2 sources.