418人 Affected, 4176萬元 Returned
Bank SinoPac experienced an abnormal customer transfer incident on 3日, and Chairman 曹為實 and President 莊銘福 held a press conference on 4日 to explain and bowed to apologize. According to statistics, 418 affected customers with 427筆 were involved, with a total transferred amount of 4176萬元, mostly 10萬元 per transaction and a few ranging from 1 to 10萬元. The bank said that by 下午2時51分 on 4日 all improper remittances had been returned to customer accounts, with advance payments made by the bank, and customers suffered no actual loss of funds.
Responded Upon Morning Reports, Blocked Attack in Afternoon
莊銘福 described the timeline: at 上午9時29分 on 3日 the bank received calls from about 10 customers, initiated relevant procedures at 10時, notified the receiving banks and froze accounts at 上午10時30分, confirmed it as a major contingent incident at 中午12時, and notified the FSC by phone at 中午12時51分. The bank also reported to police and engaged a third-party information security firm to assist with the investigation, and after confirming the cause at 下午1時47分 took the new online banking system offline, with no similar attacks occurring thereafter. The banks holding the receiving accounts have frozen the funds and notified police.
Hackers Exploited Vendor Security Configuration Vulnerability
The bank's investigation indicates the case was caused by external hackers exploiting the security settings of the new online banking transaction system vendor, constituting an information security incident. The system uses brand-new technology components from a well-known foreign manufacturer, introduced only by Bank SinoPac in Taiwan's financial industry. The bank stressed that strict testing and handover procedures were followed during implementation, and this was an abnormal exception. As prosecutors and police have launched an investigation, technical details cannot be disclosed. Regarding whether a similar incident occurred in early October, the bank said after reviewing customer complaints that the two are unrelated.
Claims Victim Status, to Seek Compensation from Overseas Vendor
曹為實 said he deeply regrets the inconvenience caused to customers and the public, apologized on behalf of the bank, and will actively investigate and improve in the future to protect customer funds and personal data. 莊銘福 stressed the bank itself is also a victim, has formally reported to prosecutors and investigators, and is now comprehensively reviewing and preserving evidence. Although there was no actual monetary loss, its reputation was damaged, and it will legally seek compensation from the overseas supplier to defend the rights of customers and the bank, while continuing to strengthen information security protection.