Bank SinoPac, a Taiwanese lender, said external hackers exploited security settings at a supplier to make NT$41.76 million in unauthorized transfers through its new online banking system, affecting hundreds of customers.
At a Nov. 4 press conference, the bank put the count at 427 transfers across 418 customers, totaling NT$41.76 million. CNA reported that individual transfers ranged from NT$10,000 to NT$100,000, with most at the upper end.
Focus Taiwan reported that the Financial Supervisory Commission (FSC) had counted 419 affected customers on Nov. 3. SinoPac’s later total was lower by one; the reports did not say what accounted for the change.
The bank said it blocked the method used in the attack and strengthened verification. It brought in a third-party cybersecurity team to check security and personal data, increased monitoring for unusual activity and shared threat information through F-ISAC. SinoPac said the evidence it had reviewed showed no trace of personal data leakage, while the additional checks continued.
SinoPac said the affected service had been suspended and all funds, including transaction fees, were returned on Nov. 3. SinoPac President Eric Chuang said customers had suffered no monetary loss and the bank would seek compensation from the supplier, CNA reported. SinoPac did not name the supplier.
SinoPac said no other financial institution in Taiwan had adopted the transaction system. CNA reported that five entities used it; the two accounts leave the scope of those entities’ use unclear.
SinoPac’s Nov. 3 notice described a program anomaly. The bank attributed the incident the following day to hackers exploiting supplier security settings. Focus Taiwan reported that the FSC expected a detailed incident report by Nov. 12 and would consider further action after reviewing the cause and severity. CNA separately reported that the Taipei District Prosecutors Office had opened an investigation into computer-security violations.
