Ribbon Communications, a critical U.S.-based telecom firm enabling global real-time communications infrastructure, suffered a year-long undetected breach by nation-state hackers. The intrusion, discovered in September 2025 (with initial compromise traced to December 2024), involved unauthorized access to four older customer files stored on two laptops outside the main network. While no 'material information' or customer systems were compromised, three smaller customers were notified of exposure. The breach aligns with a broader trend of state-sponsored espionage targeting telecom providers (e.g., Salt Typhoon campaign), exploiting supply-chain vulnerabilities. Ribbon serves high-profile clients, including Verizon, BT, Deutsche Telekom, and the U.S. Department of Defense, amplifying risks to critical infrastructure. The attackers were evicted post-discovery, but the stealthy, prolonged access—potentially linked to Chinese APT tactics—highlights systemic gaps in detecting advanced threats. Federal law enforcement and external experts are investigating, though the full scope of reconnaissance or future exploitation remains unclear.