Recently, a series of major cybersecurity incidents have occurred in Taiwan. After the launch of the new version of E.Sun Bank’s online banking system, more than 400 customers had over NT$40 million transferred from their accounts without logging into the new app; the order database of e-commerce cloud service provider 91APP was hacked, potentially affecting more than 1,300 brands and nearly 4.8 million consumers.
Subsequently, several other e-commerce platforms also reported cybersecurity warnings. Although the two incidents are different in nature, they reveal the same fact: hackers are constantly testing system vulnerabilities.
Let’s look at the system aspect first. The initial launch of a new system is often the most vulnerable time for protection. Program flaws, configuration oversights, and unpatched weaknesses are precisely the targets for hackers to launch “zero-day attacks.” The E.Sun Bank incident was investigated and found to be due to the exploitation of security configuration vulnerabilities by a foreign system vendor; the 91APP incident was caused by a third-party tool not being patched in time, allowing attackers to gain easy access. More and more companies are outsourcing the operation of their marketing platforms, membership systems and apps, but they must recognize that outsourcing can divide the work, but it cannot absolve them of responsibility. Supply chain security audits, pre-launch penetration testing, and ongoing vulnerability management should all be core operational priorities.
Regarding the response, after discovering the anomaly, E.Sun Bank immediately notified its regulatory authorities, police, and receiving banks. All funds were deposited and returned to customers on the same day. Simultaneously, threat intelligence was shared with industry peers through the Financial Security Information Sharing and Analysis Center (F-ISAC), creating a joint defense alert. This is precisely the key to the “golden time” in handling cybersecurity incidents.
It’s worth noting that the hackers in this case seemed more like they were testing vulnerabilities than showcasing their skills. If relevant institutions had failed to detect and respond in time, the next step could have been to disperse the funds into nominee accounts or even engage in cross-border money laundering, significantly increasing the difficulty of recovery.
Fortunately, in recent years, regulations on nominee accounts have become stricter, and the mechanisms for alerting and freezing accounts have become increasingly sophisticated. The “lifespan” of nominee accounts is getting shorter, making it much more difficult for hackers to successfully convert stolen funds into cash. This also illustrates that cybersecurity protection must be integrated with anti-fraud systems; both technical defenses and the interception of funds are indispensable.
Compared to the financial industry, which has had F-ISAC for a long time, retail and e-commerce operators have clearly lagged behind in intelligence sharing. It took 91APP ten days from receiving its first fraud complaint to confirming the attack vulnerability. If there had been an intelligence exchange platform between industries earlier, the full picture might have been pieced together much sooner. The government is currently actively promoting R-ISAC in the retail industry, hoping to facilitate seamless intelligence flow between finance, retail, e-commerce, and law enforcement through industry cooperation.
Cybersecurity is never just the responsibility of a single company or IT department; it is a public issue concerning social trust. Only when companies take responsibility, industries share information, and the government integrates and collaborates can a solid protective wall against financial crime be built. (Related report: Yao Wencheng’s view: “Administering according to law” becomes a “cybersecurity loophole”! A critique of the power expansion crisis of Taiwan Tobacco & Liquor Corporation’s real-name registration system for alcohol | More articles)
*The author is an assistant professor in the Department of Criminal Justice at Ming Chuan University and the chairman of the Publicity and Education Committee of the Taiwan Anti-Fraud Association.