Taiwan’s cyber agency said a recent attack wave affected more than 1 million personal data records, underscoring risks to businesses as intruders exploited software flaws and used artificial intelligence (AI) tools.
The Administration for Cyber Security, within Taiwan’s Ministry of Digital Affairs (MODA), said Nov. 11 that more than 10 businesses and online platforms were affected. Its preliminary assessment linked nearly half of the incidents to AI, but officials provided neither an incident total nor an exact share.
The agency identified known high-risk vulnerabilities in PHP, Node.js and GitLab among the weaknesses exploited. It also said attackers accessed information through APIs with elevated permissions. Some cases combined AI automation with ARTEX, a penetration-testing tool.
The ministry placed overseas hackers’ use of AI-agent tools as far back as July. It said the recent activity has reached commercial businesses and online platforms alongside government agencies.
MODA did not identify the affected businesses. In a separate filing, 91APP described the maximum potential scope of its own incident as 4,798,255 consumers across 1,329 brands, based on online orders from Apr. 4, 2025, through Oct. 14, 2026. The company said it could not determine whose data had been accessed without authorization. Its stated scope excluded passwords and payment data.
The ministry said exposed order information could help fraudsters pose as retailers. It urged companies to patch software flaws, limit data access and collect only the personal information needed to provide their services. MODA also said businesses could face legal liability if failing to take required action caused harm.
Digital-economy businesses should report personal data breaches to the relevant authority within 72 hours, notify affected people and contain incidents during that period, the ministry said. It also called for companies to submit improvement plans within one month of an incident.
