The most likely source of said claims would be something like SolarWinds's customer list, which they took offline in December. http://web.archive.org/web/20201

The most likely source of said claims would be something like SolarWinds's customer list, which they took offline in December. http://web.archive.org/web/20201214030038/https://www.solarwinds.com/company/customers http://web.archive.org/web/20201214030038/https://www.solarw... "Our customer list includes: ... All ten of the top ten US telecommunications companies" I see... AT&T, Sprint, Comcast, Level 3 (now CenturyLink, still AS3356) for US-based ISPs. Telecom Italia made the shortlist, too. (And an honorable mention for Cisco, which was also apparently explicitly targeted: https://tools.cisco.com/security/center/resources/solarwinds_orion_event_response; https://tools.cisco.com/security/center/resources/solarwinds... "While Cisco does not generally use SolarWinds for its enterprise network management or monitoring, we have isolated and removed the Orion installations from a small number of Cisco assets.") That said, it doesn't say anything about _how_ the ISPs were using SolarWinds, just that they were in some capacity. But with any infiltration, it doesn't matter if it's widely used, so long as it's used somewhere that can be used as a launching pad for a follow-up attack. edit: apparently CenturyLink rebranded as Lumen last year. They're still AS3356 (and its subsidiary networks) to me.