AI used in cyberattacks, some originating in HK

Nearly half of cyberattacks targeting more than 10 businesses and online platforms in Taiwan in the past few weeks involved artificial intelligence (AI), with some attack traffic appearing to originate from Hong Kong, the Ministry of Digital Affairs said yesterday.

The attacks affected more than 1 million personal records, including names, phone numbers, e-mail addresses and order details, officials told a news conference in Taipei.

Administration for Cyber Security official Julius Huang (黃卓倫) said preliminary investigations linked nearly half the attacks to AI, with some involving ARTEX, a Chinese-developed tool used to test security weaknesses in systems or Web sites.

Minister of Digital Affairs Lin Yi-jing, left, and Administration for Cybersecurity Director-General Tsai Fu-lung hold a news conference at the ministry in Taipei yesterday.

Photo: CNA

“AI helps hackers automatically find doors and try keys,” Huang said, adding that the technology enables attackers to exploit “security vulnerabilities,” such as weak passwords and unpatched software, quicker and at lower cost.

No breaches of credit card or other payment information have been confirmed in the cases reviewed, Huang said.

The latest wave began around mid-September, with the first cases reported in South Korea, National Institute of Cyber Security president Dennis Kung (龔化中) said.

The authorities had identified several attacks in Taiwan by Oct. 20, and the wave was still ongoing, he said.

Some attack traffic appeared to come from Hong Kong, while others were routed through servers in different countries, Kung said.

“If they came from within Taiwan, we would definitely catch them, but the cases we have seen so far have all come from overseas,” he said.

Minister of Digital Affairs Lin Yi-jing (林宜敬) said that Internet protocol addresses traced to Hong Kong did not establish the hackers’ actual locations.

Lin declined to name the affected businesses, citing potential financial and reputational damage.

“For publicly traded companies, it could affect their share prices,” he said. “For non-listed companies, commenting on individual cases could damage their reputations.”

Companies that have disclosed breaches include e-commerce service provider 91APP, which said up to 4.8 million consumers could have been affected, and online travel agency ezTravel, which reported more than 690,000 affected members.

The ministry did not confirm whether either company was included in its tally.

Lin said companies could face legal liability if breaches led to fraud-related losses, but he did not address whether consumers could seek compensation for the exposure of their personal data alone.

Administration for Digital Industries Deputy Director-General Huang Ya-ping (黃雅萍) said that digital economy businesses were required to report personal data breaches to the ministry within 72 hours of becoming aware of them.

The ministry also urged businesses to notify affected customers and take steps to contain breaches within 72 hours of discovering the breach, as well as submit improvement plans within one month.

Huang said that scammers could use leaked details to impersonate retailers and lure people into fake customer service accounts on the Line messaging app under the pretext of canceling recurring payments.