AI cyberattack spreads to all countries! More than 10 companies in Taiwan were victimized. Information Security Agency: The attack is not over yet

The Information Security Administration pointed out that more than ten companies and online platforms in Taiwan have experienced successive security incidents, affecting more than one million pieces of personal information. (AFP)

[Reporter Qiu Qiaozhen/Taipei Report] In the face of overseas hackers using AI Agent tools to launch cyber attacks since July this year, and the recent attack targets have expanded from government agencies to various enterprises and Internet platforms, the Information Security Administration of the Ministry of Digital Development pointed out on the 11th that the world and Taiwan are facing the threat of AI automated cyber attacks with faster attack speed, lower cost, and larger scale. In response, the Information Security Administration called on businesses to implement three major response measures: "fix loopholes", "notify customers" and "minimize personal information", and reminded the public to be more vigilant to prevent the risk of precision fraud that may arise after personal information is leaked.

Huang Zhuolun, leader of the Information Security Agency's Reporting and Response Team, pointed out that recent global cyber attacks have continued to occur, with companies and government agencies being hacked one after another in Japan, South Korea and France, and some victims have been affected by attacks on outsourced vendors. With the rapid development of artificial intelligence (AI) technology, cyber attacks have gradually shown a trend of using AI proxy tools to launch attacks.

Judging from international cases, after the information security incident was reported in Japan in September, in October, companies and institutions such as Sagawa Express, Capcom, Rakuten Travel, the Digital Agency, and multiple local police stations were reported to be affected. A total of hundreds of companies and institutions were involved, and some of the cases were related to the hacking of outsourced manufacturers.

In South Korea, between September 30 and November 3, a total of 37 financial companies were involved in information security incidents, with a total of 40 data leakage notifications, about 473,000 pieces of information were affected, and it was reported that about 1 billion won of money had been stolen. The local competent authorities also planned to conduct inspections on more than 580 financial companies.

In France, there were reports of refrigeration equipment being attacked by cyberattacks. From October 11th to 12th, approximately 700 supermarket refrigeration equipment was remotely controlled, resulting in the loss of fresh products; from November 2nd to 3rd, another three blood bank refrigeration equipment was reported to be hacked, but fortunately no losses were caused.

In addition, since July this year, overseas hackers have been observed using AI proxy tools to attack Chinese government agencies. Recently, related attacks have also expanded to different areas such as general enterprises and online stores.

The Information Security Administration pointed out that in Taiwan, more than a dozen companies and online platforms have experienced security incidents one after another, and more than one million pieces of personal information have been affected. Most of the hacked personal information is name, phone number, email, order information, etc. The information available so far does not indicate that credit card and other payment information has been compromised. Nearly half of the incidents were related to AI attacks, including many cases of AI automated attacks combined with China's ARTEX penetration testing tool.

In terms of attack methods, hackers mostly use known high-risk vulnerabilities to launch attacks, involving related software or platforms such as PHP, Node.js, and GitLab. Some vulnerabilities have been included in the Known Exploited Vulnerability List (KEV).

In addition, application programming interfaces (APIs) have also become a hotspot for hacker attacks, because it is relatively easy for APIs to obtain large amounts of data, and some APIs have higher permissions, which can easily cause a major impact if hacked.

Huang Zhuolun also pointed out that although AI technology may make network attacks faster and cheaper, many attacks still exploit existing security weaknesses such as system vulnerabilities that have not been patched in time and insufficient password strength. Therefore, in addition to paying attention to emerging AI attack methods, enterprises should also continue to implement basic security protection measures such as vulnerability patching, password management, and access rights control.

Gong Huazhong, director of the Information Security Institute, added that when Taiwan held a press conference in late October, it already knew that several companies had been attacked. As for when this wave of attacks will end, Gong Huazhong said that for now, he can only say that "the attacks are not over yet."

He further pointed out that it is currently observed that the source of some attacks is mainly from Hong Kong IP, but it is also found that many attacks are carried out through springboards, and the attack traffic comes from different countries. Because hackers often use springboards, the actual location of the hacker cannot be determined based on the IP source alone. In principle, if the attack is launched from Taiwan, there should be a way to trace it. However, the attacks observed so far all come from abroad.

In response to the list of victim companies that are of concern to the outside world, Minister of Digital Development Lin Yi-king said that there are currently about a dozen victim manufacturers that have been notified of this wave of information security incidents, but the size of each company and the degree of impact are different, among which there are about five or six larger companies, as previously explained in the Legislative Yuan.

As for why he did not publish the list of victims, he explained that for listed companies, relevant information may affect stock prices, and the Digital Development Department is not the competent authority in this regard. As for non-listed companies, commenting on individual cases may also affect the company's goodwill and even cause legal problems. Therefore, it is currently inconvenient to publish the list of victim companies or comment on individual cases.

Lin Yijing said that each case is still under investigation, and the Ministry of Industry and Commerce will also conduct administrative inspections. He emphasized that the main purpose of administrative inspections is not to impose penalties, but to help companies respond to cyber attacks. After companies complete the response measures they should take, they will further consider subsequent reviews and improvements. As for how many companies will be affected in the future, there is currently no way to predict or predict. The most important thing at this stage is for the government and private companies to work together to increase vigilance and take protection.