CriticalBreach
One Hacker Uses 12 AI Agents to Breach Taiwan’s Emergency Services and Steal Sensitive Data
Cyber Security News·Source published ·1 min read
What happened?
A single operator in Taiwan built a team of 12 AI agents and used it to attack hundreds of organizations in 11 countries. The campaign hit emergency services, banks, universities, and military systems. It led to confirmed theft of medical data and personal records. The setup, named BOSSAI, shows how one person with rented GPUs and open-source tools can now run a campaign that once needed a full team. Some of the agents wrote code, some scanned websites, and some carried out the attacks. The operator sat in the middle and passed results between them.
Key details
- One operator used 12 AI agents to attack hundreds of organizations across 11 countries.
- Hermes agent performed most attacks with 95 sessions and 18,311 messages.
- Taiwan emergency services were breached, exposing ECG readings, ambulance video, and vital signs from 2018.
Affected
- Taipei fire-department patient-care platform exposed medical data.
- Taiwan city 119 dispatch system case records accessed across seven districts.
- Lender with 16 SQL injection points was compromised.
- Fire-dispatch vendor database accessed via default root credentials.
- Outside Taiwan, about 206,800 residential phone records in Mexico were collected.
- Thailand: 489 targets across 45 universities, data pulled from three.
Fixes and mitigations
- Patch exposed databases, remove default credentials, and close old ports.
- Put login checks in front of every API, including those serving dispatch and medical data.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.