Eight of the largest U.S. communications companies have formed the C2 ISAC — an Information Sharing and Analysis Center dedicated to cybersecurity collaboration across the telecom sector. The announcement, distributed May 18, 2026 via the AT&T Newsroom, positions the new body as a vehicle for member carriers to exchange threat intelligence and coordinate defenses against attacks on communications infrastructure.

Executive Summary

An ISAC is a member-run clearinghouse where companies in one industry share indicators of compromise, attack patterns, and defensive playbooks — a model pioneered by the financial sector’s FS-ISAC in 1999 and since replicated across critical infrastructure. What is notable here is not the model but the participants: eight direct competitors, including AT&T, standing up a purpose-built cybersecurity body for communications rather than relying solely on existing government-coordinated channels.

The move lands in a sector still absorbing the lessons of the publicly reported Salt Typhoon intrusions, in which a China-linked espionage campaign penetrated multiple major U.S. carriers and was disclosed beginning in late 2024. Whatever the C2 ISAC’s precise mandate turns out to be, its formation is a clear signal that the operators of America’s communications backbone believe collective, industry-led defense is now table stakes — and that the existing sharing arrangements were not enough on their own.

Why Telecom Is Building Its Own War Room

Telecom networks are uniquely attractive targets: compromise one carrier and you can potentially observe the communications of millions of customers, including government and enterprise traffic. The Salt Typhoon campaign made that risk concrete, with public reporting indicating intruders reached deep into carrier systems, including infrastructure tied to lawful-intercept functions. Against that backdrop, a formal, carrier-owned threat-sharing body reads as an institutional response — turning ad-hoc cooperation during a crisis into a standing capability.

The sector was not starting from zero. Communications companies have long participated in government-coordinated sharing through bodies descended from the Communications ISAC and in cross-sector work with the Cybersecurity and Infrastructure Security Agency (CISA). Creating a new, industry-controlled center suggests the founders wanted something those channels did not fully provide — plausibly faster peer-to-peer exchange, tighter operational trust among a small membership, or an agenda set by carriers rather than convened by government. The release headline emphasizes collaboration; the substance will be in how the body differs from what already existed.

The Economics of Shared Defense

Cyber threat intelligence has an unusual economic property: sharing it costs the giver little and can save the receiver enormously, because attackers reuse infrastructure and techniques across targets. An indicator of compromise spotted on one carrier’s network — a malicious IP address, a tampered configuration, a phishing kit — is often the early warning that lets seven others block the same campaign. Pooling that signal across eight national-scale networks creates a sensor grid no single company could build alone.

The catch is that sharing bodies live or die on trust and reciprocity. Members must be willing to disclose incidents that are commercially embarrassing, and to do so fast enough for the intelligence to matter. The U.S. Cybersecurity Information Sharing Act of 2015 provides liability protections designed to encourage exactly this, but ISACs across industries have historically struggled with free-riding — members who consume intelligence without contributing. A small founding group of eight peers, rather than a sprawling open membership, may be a deliberate design choice to keep contribution norms enforceable.

Ripple Effects Down the Infrastructure Stack

Carriers do not defend their networks in isolation. Their infrastructure runs through data centers, interconnection points, and cloud platforms, and their security posture directly affects every enterprise that buys transit, transport, or managed services from them. If the C2 ISAC succeeds in shortening the time between one member detecting a campaign and all members blocking it, the benefit flows downstream to customers who never see the machinery — fewer carrier-side compromises means fewer avenues into the businesses that ride those networks.

There is also a competitive dimension. Security is increasingly a procurement criterion for enterprise and government connectivity contracts, and visible participation in a serious sharing body is a credential. For carriers outside the founding eight — regional operators, rural providers, wireless resellers — the open question is access: whether the C2 ISAC’s intelligence eventually reaches the broader ecosystem, or whether it deepens a capability gap between the largest operators and everyone else. Smaller operators have historically been the softer targets, so the sector-wide payoff depends on how far the sharing extends.

Background

ISACs trace to Presidential Decision Directive 63 in 1998, which urged each critical-infrastructure sector to build a hub for sharing threat information; the financial sector’s FS-ISAC, founded in 1999, became the template. The communications sector has participated in government-coordinated sharing for decades, but the disclosures beginning in late 2024 of the Salt Typhoon espionage campaign — which publicly reported accounts say penetrated multiple major U.S. carriers — sharpened scrutiny of whether existing arrangements moved fast enough. The C2 ISAC, announced in May 2026 with AT&T among its eight founding firms, is the sector’s most visible institutional answer to that question so far.

Source: Eight Leading U.S. Communications Firms Form C2 ISAC to Strengthen Cybersecurity Collaboration — AT&T Newsroom release announcing the formation of a telecom-sector cybersecurity information sharing and analysis center.