FBI cyber cop: Salt Typhoon pwned 'nearly every American'

I live in a state, Washington, with mandatory breach reporting and notifications.

Haven't seen anything from this. Any idea why? Low compliance in general? Telcos think they're big enough to ignore state regs?