AI Automated Scanning Expands Attacks Across Industries
Minister of Digital Affairs Lin Yi-jing said that multiple recent cyberattacks and personal data leaks in Taiwan, from 91APP and ezTravel to other brands, have affected over 1 million personal data records, with some incidents involving AI-related attack techniques. Direct financial losses from this wave are small, with no direct theft of money or extortion, but personal data accounts sold to fraud groups further damage brand reputation, and the indirect financial losses behind it are likely enormous. The Ministry of Digital Affairs urgently convened a press conference to explain recent AI cyberattack trends, common attack methods and key cybersecurity protection measures, and called on enterprises to strengthen information security management and properly handle personal data leak incidents, while reminding the public to stay vigilant against secondary fraud, verify information through official channels, and use security measures such as two-step verification.
Frontier Models Find Vulnerabilities to Form Kill Chains
Lin Yi-jing said that with AI development, frontier AI models can now find cybersecurity vulnerabilities and form kill chains into a series of attack techniques to intrude into systems. This current wave of cyberattacks builds on this foundation to automatically scan websites around the world, and Taiwan's recent cybersecurity incidents and personal data leaks were attacked by the same method. Huang Zhuo-lun, head of the Notification and Response Division of the Administration for Cyber Security, pointed out that the same method is rampant not only in Taiwan, with over a hundred companies including contractors victimized in Japan, over a thousand financial companies hacked in South Korea causing 473,000 records breached and 1 billion Korean won stolen, and recently even freezers victimized in France, with attacks spanning all industries, showing AI scanning has breached defenses across industries.
ARTEX Tool Accelerates Intrusion, APIs Hardest Hit
Regarding Taiwan's recent cyberattack incidents, Huang Zhuo-lun said that in known personal data leak cases, victim data mainly includes names, phone numbers and other personal information, with no credit card or other financial information found leaked so far. Analysis of victim cases shows nearly half of attacks are AI-related, with hackers also combining ARTEX automated penetration testing tools to improve efficiency in finding system vulnerabilities and launching attacks. Common attack methods mostly target high-risk hotspots, with affected platforms including PHP, Node.js, GitHub and others, among which APIs are also popular targets because APIs can access large amounts of data, some with higher privileges, causing greater impact once intruded. AI helps hackers automatically find doors and keys, accelerating the search for system weaknesses. If systems have not adopted second-factor authentication such as SMS or APP, hackers may intrude into accounts by guessing passwords and further connect to other systems. Hackers also target old unpatched corporate vulnerabilities, and since related vulnerabilities and fixes have long been disclosed, AI can quickly write attack programs to search for and attack websites that have not completed updates.
Ministries Propose Three Response Measures, Urge Prompt Customer Notification
Huang Zhuo-lun urged companies hit by cybersecurity incidents to proactively notify customers ahead of fraud groups, without waiting until all investigations are completed, but first confirm the potentially affected scope, clearly inform the types of leaked data, and remind consumers of things the company will never ask, such as never asking people to operate ATMs to process refunds, while also notifying relevant contractor platforms to prevent risks from expanding. Companies should routinely implement the principle of minimal personal data collection, collecting only data necessary for business with clear retention periods, deleting unneeded personal data after expiry, and in data management, adopt separate storage, encryption and masking measures. Gong Hua-zhong, president of the National Institute of Cyber Security, suggested first urgently reducing system exposure by temporarily shutting down idle or non-essential systems, and if risks continue to expand, the most thorough mitigation is to temporarily shut down all external connections, second conducting full forced logout and password changes without relying solely on two-factor authentication, and third strengthening database monitoring to immediately alert and block access once large volumes of abnormal access are found. Huang Ya-ping, deputy director-general of the Administration for Digital Industries, said currently affected brands cover apparel, food, pet supplies and household goods industries, and operators must cooperate with three actions, including notifying competent authorities within 72 hours and cooperating with administrative inspections, proactively notifying consumers and providing inquiry channels, reminding them to watch for suspicious emails or messages and not click unknown links, and identifying the cause and completing vulnerability remediation.