The Gemalto hack, by the U.S. National Security Agency and the U.K. Government Communications Headquarters (GCHQ), allowed the two spy agencies to monitor a large portion of the world's mobile phone voice and data traffic, according to a story in The Intercept.
The hack was detailed in a 2010 GCHQ document leaked by former NSA contractor Edward Snowden, the story said.
It's unclear how much mobile traffic the two agencies intercepted after the reported hack.
Gemalto, based in the Netherlands, produces about 2 billion SIM cards a year. About 450 mobile carriers, including AT&T, T-Mobile, Verizon Wireless and Sprint, use the company's SIM cards.
With the compromised encryption keys, the surveillance agencies would be able to monitor mobile communications without the approval of the carriers or foreign governments, The Intercept story said. The encryption keys would allow the agencies to intercept mobile traffic without court-ordered warrants or wiretaps, the story said.
A representative of the NSA did not immediately respond to a request for comment on the story.
Gemalto was unaware of the penetration of its systems, the company told The Intercept. The company is "disturbed" about the possibility, Paul Beverly, a Gemalto executive vice president, told the publication.
Gemalto will devote "all resources necessary" to investigate the reported compromise, the company said in a statement.
The company is "especially vigilant against malicious hackers, and of course, has detected, logged and mitigated many types of attempts over the years," the statement continued. Gemalto "can make no link" between past attacks and the reported compromise by GCHQ the NSA, the company said.
GCHQ compromised Gemalto's computer networks and installed malware on several computers, The Intercept story said, quoting a slide from the U.K. intelligence agency provided by Snowden. At the time GCHQ believed it had access to the company's "entire network," the slide said.
GCHQ also said it had access to billing servers of mobile carriers, allowing it to manipulate customer charges in an effort to hide surveillance on phones, the story said.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is grant_gross@idg.com.