Cyberattack on northeast Wisconsin wireless company behind weeklong service problems

A cyberattack on a Wisconsin-based cell phone company has affected phone service for thousands of people over the last week.

Cellcom, a regional wireless company that serves Wisconsin and Michigan’s Upper Peninsula, first reported that its voice services were experiencing an outage May 14 and reported an outage with its SMS text services the following day.

The Green Bay area-based cell phone provider is the “sixth-largest wireless operator in the country,” according to a 2024 report from a pair of national telecommunications trade associations.

On Monday, the company said its texting services had been restored and that Cellcom customers were able to make calls with other Cellcom customers. Then on Tuesday, it released a letter and video message from Cellcom CEO Brighid Riordan.

In the video, Riordan said the company was dealing with a “cyber incident” that was “segmented to the voice and texting” parts of its service — separate from where it stores sensitive customer information, like names, addresses and financial information.

“We have notified authorities, and we have teams working around the clock,” she said in the video. “We have no evidence that your personal information was impacted.”

According to the letter, the company has notified the FBI and state law enforcement of the situation and is working with “outside cybersecurity experts.” Riordan wrote that company officials “expect to have the rest of service restored this week.”

A spokesperson for Cellcom declined to provide additional information related to how many customers have been affected.

Tyler Baeten, a cybersecurity specialist instructor at Fox Valley Technical College, said the Cellcom outage is a “serious reminder” that cyberattacks aren’t just about stolen data or compromised passwords. He said cyber criminals are increasingly targeting infrastructure or services that people rely on daily.

“Even if your personal data wasn’t stolen, a cyberattack that knocks out your phone or internet can still disrupt your life,” Baeten said. “That’s why these incidents matter. They highlight just how connected and dependent we are on technology.”

Other Wisconsin-based organizations have been hit by cyberattacks in recent years. Health care providers Ascension Wisconsin, Hospital Sisters Health System and Prevea Health were hit with cyberattacks in 2024 and 2023. And nearly two years ago, a cyberattack knocked out Kwik Trip’s loyalty program and internal company systems.

“The bad guys, or the threat actors, know that by targeting these essential services — whether it’s a phone line, fuel or even a hospital network — they can create chaos, urgency and pressure,” Baeten said. “And that’s going to make organizations more likely to pay ransoms.”

Michael Patton, director of the Cybersecurity Center of Excellence at the University of Wisconsin-Oshkosh, said telecommunications companies specifically have become “rich targets” for hackers with backing from adversarial nations.

Last year, hackers with a Chinese-affiliated group targeted several prominent telecommunications companies, including Verizon, AT&T, Lumen Technologies and T-Mobile, causing disruptions and security concerns, according to cybersecurity company SOCRadar Cyber Intelligence.

But it isn’t just cellular infrastructure that rival countries have also shown interest in, Patton said.

“Our adversarial nations are really taking a look at embedding themselves in all of our important infrastructure, so that in case tensions escalate worldwide to a place either at war or bordering war, they can take actions and damage us,” he said. 

In Cellcom’s case, Patton said the target being voice and text services could indicate that those services were the “easiest gateway to the rest of the network.” 

That’s why, he said, it’s important for organizations to segment their data across different parts of the network and create hurdles in moving between parts of the network.

“Even if voice and data aren’t the end goal, that may be where the weakest link was, and their plan was to move laterally into places where there was consumer data or financial data and they just hadn’t gotten there,” he said.